CVE-2025-68457: 
JavaScript vulnerability analysis and mitigation

CVE-2025-68457 is a Cross-Site Scripting (XSS) vulnerability in Orejime, an accessibility-focused consent manager for the web. The flaw exists in all versions of the npm package orejime prior to 2.3.2, where malicious javascript: URIs embedded in HTML data attributes could be executed when a user consents to a tracked purpose. The vulnerability was reported by researcher Rudloff on December 13, 2025, and publicly disclosed via a GitHub Security Advisory on December 19, 2025. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 0.6 (Low) (GitHub Advisory).

The root cause is improper neutralization of user-controllable input during web page generation (CWE-79). Orejime's consent management logic converts prefixed data attributes (e.g., data-href) into their unprefixed equivalents (e.g., href) when a user grants consent for a related purpose. If an attacker can inject HTML into the page containing a data-href="javascript:maliciousCode()" attribute on an Orejime-managed element, the conversion will produce an executable href attribute, triggering JavaScript execution in the victim's browser. The fix, implemented in pull request #143, enforces URL validation to ensure only HTTP/HTTPS protocols are accepted, using the URL object for proper handling of relative URLs (GitHub PR #143, GitHub Advisory).

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of a victim user's browser session, potentially enabling session hijacking, credential theft, unauthorized actions on behalf of the user, or data exfiltration. The impact is limited to confidentiality and integrity of the subsequent (browser) system — availability is not affected. Exploitation is conditional on a prior HTML injection vulnerability existing in the target application, which significantly constrains the real-world attack surface (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.045% (7th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a precondition of HTML injection capability on the target site, further reducing practical exploitability (GitHub Advisory).

1. Identify a target: Find a web application using Orejime (npm package) versions prior to 2.3.2 that also has an HTML injection vulnerability allowing attacker-controlled content to be inserted into the page.
2. Inject malicious HTML: Craft an HTML element that Orejime manages (e.g., a script or link element with a consent-related data attribute) containing a javascript: URI, such as <a data-href="javascript:alert(document.cookie)" data-name="analytics">...</a>.
3. Deliver to victim: Lure a victim user to the page containing the injected HTML (e.g., via a phishing link or stored injection in a shared page).
4. Trigger consent action: Wait for or socially engineer the victim to interact with the Orejime consent manager and consent to the purpose associated with the injected element.
5. Code execution: Orejime converts data-href to href, causing the browser to execute the embedded javascript: payload in the victim's session, enabling cookie theft, session hijacking, or further malicious actions (GitHub Advisory, GitHub PR #143).

• Network: Unexpected outbound requests from a user's browser to attacker-controlled domains following interaction with a consent manager dialog on a site using Orejime.
• Logs: Web server or CDN access logs showing unusual or unexpected HTML content being served that includes data-href or data-src attributes containing javascript: URIs.
• Browser/Client-Side: Browser developer console errors or unexpected JavaScript execution events triggered immediately after a user clicks "Accept" or consents within the Orejime consent UI.
• File System / CMS: Presence of injected HTML fragments containing javascript: protocol strings within data-* attributes in CMS content, templates, or user-generated content fields.

Upgrade the orejime npm package to version 2.3.2 or later, which validates URLs in tag attributes to enforce HTTP/HTTPS protocols and reject javascript: URIs. As a workaround for environments that cannot immediately upgrade, sanitize all HTML attributes that could contain executable code (particularly data-href, data-src, and similar) before they are processed by Orejime. Additionally, review and restrict any user input or third-party content that could inject HTML into pages where Orejime operates (GitHub Advisory, GitHub PR #143).

The vulnerability was reported privately by researcher Rudloff via a GitHub issue on December 13, 2025, and the maintainer (felixgirault) responded promptly with a patch merged on December 18, 2025, and a public advisory published on December 19, 2025. The issue was noted by automated vulnerability tracking services including CIRCL Vulnerability Lookup, VulnDB, and INCIBE-CERT, but did not generate significant broader community discussion, consistent with its low severity rating and limited exploitability (GitHub Issue #142, GitHub Advisory).