Platform
nodejs
Component
contenttools
Fixed in
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.15
1.6.16
1.6.17
1.6.17
CVE-2025-2699 is a Cross-Site Scripting (XSS) vulnerability affecting ContentTools versions up to 1.6.16. This vulnerability allows attackers to inject malicious scripts into the application, potentially leading to session hijacking or defacement. The issue resides within the Image Handler component and is triggered by manipulating the onload argument. A fix is available in version 1.6.17.
Successful exploitation of CVE-2025-2699 allows an attacker to execute arbitrary JavaScript code in the context of a user's browser. This can lead to various malicious outcomes, including stealing session cookies, redirecting users to phishing sites, or modifying the content of the web page. The impact is particularly severe if the application handles sensitive user data or performs critical operations. Given the XSS nature, the attack can be launched remotely, making it accessible to a wide range of potential attackers.
This vulnerability was publicly disclosed on 2025-03-24. The vendor, GetmeUK, was contacted but did not respond. The vulnerability has a LOW CVSS score (3.5), indicating a relatively low probability of exploitation in the absence of active campaigns. No public proof-of-concept (POC) code has been observed as of the disclosure date, but the public nature of the disclosure increases the likelihood of future exploitation.
Exploit Status
EPSS
0.08% (24% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-2699 is to upgrade ContentTools to version 1.6.17 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the Image Handler's onload argument to sanitize user-supplied data. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Thoroughly review and sanitize all user inputs to prevent injection attacks.
Update the ContentTools library to a version later than 1.6.16, if available, to fix the XSS vulnerability. If a patched version is not available, consider disabling or replacing the Image Handler component until an update is released. Carefully review and validate any user-provided input to the Image Handler component to prevent the injection of malicious scripts.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-2699 is an XSS vulnerability in ContentTools versions up to 1.6.16, allowing attackers to inject malicious scripts via the Image Handler's onload argument.
You are affected if you are using ContentTools version 1.6.16 or earlier. Upgrade to 1.6.17 to resolve the issue.
Upgrade ContentTools to version 1.6.17 or later. As a temporary workaround, implement input validation and output encoding on the Image Handler's onload argument.
While no active exploitation has been confirmed, the vulnerability is publicly disclosed, increasing the risk of future exploitation.
Refer to the GetmeUK website or relevant security mailing lists for the official advisory regarding CVE-2025-2699.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.