p PatchFirst

CVE-2025-66421

CVE-2025-66421

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.

CVSS 5.4 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • sao

    Versions
    • ≥ 0, < 6.0.69: Affected (semver)
    • ≥ 7.0.0, < 7.0.40: Affected (semver)
    • ≥ 7.1.0, < 7.4.21: Affected (semver)
    • ≥ 7.5.0, < 7.6.11: Affected (semver)

    Update to 6.0.69; Update to 7.0.40; Update to 7.4.21; Update to 7.6.11

  • tryton-sao Debian:12

    Versions
    • 6.0.28+ds1-2
    • 6.0.28+ds1-2+deb12u1
    Affected ranges
    • ECOSYSTEM: < 6.0.28+ds1-2+deb12u2

    Update to 6.0.28+ds1-2+deb12u2

  • tryton-sao Debian:13

    Versions
    • 7.0.28+ds1-1
    • 7.0.28+ds1-1+deb13u1
    Affected ranges
    • ECOSYSTEM: < 7.0.28+ds1-1+deb13u2

    Update to 7.0.28+ds1-1+deb13u2

  • tryton-sao Debian:14

    Versions
    • 7.0.28+ds1-1
    • 7.0.38+ds1-1
    Affected ranges
    • ECOSYSTEM: < 7.0.40+ds1-1

    Update to 7.0.40+ds1-1

  • tryton-sao npm

    Affected ranges
    • SEMVER: ≥ 7.5.0, < 7.6.11

    Update to 7.6.11

  • tryton-sao npm

    Affected ranges
    • SEMVER: ≥ 7.1.0, < 7.4.21

    Update to 7.4.21

  • tryton-sao npm

    Affected ranges
    • SEMVER: ≥ 7.0.0, < 7.0.40

    Update to 7.0.40

  • tryton-sao npm

    Affected ranges
    • SEMVER: < 6.0.69

    Update to 6.0.69

  • tryton-sao Ubuntu:24.04:LTS

    Versions
    • 6.0.30+ds1-1
    • 6.0.31+ds1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tryton-sao Ubuntu:25.10

    Versions
    • 7.0.23+ds1-1
    • 7.0.28+ds1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →