NamelessMC permet une attaque de Cross-Site Scripting (XSS) stockée dans l'éditeur de texte du tableau de bord

Successful exploitation of CVE-2025-54117 allows an attacker with authenticated access to the NamelessMC dashboard to inject arbitrary JavaScript code. This code can then be executed in the context of other users accessing the dashboard, potentially leading to session hijacking, credential theft, or the injection of malicious content onto the Minecraft server website. The impact is particularly severe as the dashboard often contains sensitive information related to server configuration and user accounts. Attackers could also leverage this vulnerability to redirect users to phishing sites or install malware.

Minecraft server administrators using NamelessMC versions prior to 2.2.4 are at direct risk. Shared hosting environments where multiple Minecraft servers share the same NamelessMC installation are particularly vulnerable, as a compromise of one server could potentially lead to the compromise of others. Users who have not implemented robust password policies or multi-factor authentication are also at increased risk.

• wordpress / composer / npm:

grep -r "<script>" /var/www/namelessmc/cache/*
grep -r "<img src="javascript:" /var/www/namelessmc/cache/*

• generic web:

curl -I https://your-namelessmc-site.com/dashboard/ | grep -i 'content-security-policy'

1. 2025-08-18Disclosure

   disclosure

1. Réservé2025-07-16
2. Publiée2025-08-18
3. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-54117 is to immediately upgrade NamelessMC to version 2.2.4 or later. If upgrading is not immediately feasible, consider implementing strict input validation and output encoding within the dashboard text editor to sanitize user-supplied content. While not a complete solution, this can reduce the attack surface. Review dashboard access controls to limit the number of users with administrative privileges. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into the dashboard text editor; it should be properly sanitized and not execute.