---
cve: "CVE-2025-58361"
severity: "CRITICAL"
cvss: 9.3
epss: "0.3%"
vendor: "MarceloTessaro"
kev: false
exploited: false
published: "2025-09-04 20:15:39"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T17:29:29+01:00"
---

# CVE-2025-58361

> 9.3 CRITICAL · 🧪 PoC

## Beschreibung

Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining  LLM-powered applications. All versions contain an non-exhaustive URL scheme check that does not protect against XSS. User-controlled URLs pass through src/utils/validation.ts, but the check only strips `javascript:` and a few patterns. `data:` URLs (for example data:image/svg+xml,…) still pass. If a sanitized value is used in href/src, an attacker can execute a script. There is currently no fix for this issue.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2025-09-04 20:07:02
- CNA-CVSS: **9.3** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Erforderlich | good |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-184** — Incomplete List of Disallowed Inputs
  The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
- **CWE-20** — Improper Input Validation
  The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- **CWE-79** — Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
  The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

## Angriffsmuster (CAPEC)

- [CAPEC-3 — Using Leading 'Ghost' Character Sequences to Bypass Input Filters](https://capec.mitre.org/data/definitions/3.html) _(Severity: Medium)_
- [CAPEC-6 — Argument Injection](https://capec.mitre.org/data/definitions/6.html) _(Severity: High)_
- [CAPEC-15 — Command Delimiters](https://capec.mitre.org/data/definitions/15.html) _(Severity: High)_
- [CAPEC-43 — Exploiting Multiple Input Interpretation Layers](https://capec.mitre.org/data/definitions/43.html) _(Severity: High)_
- [CAPEC-71 — Using Unicode Encoding to Bypass Validation Logic](https://capec.mitre.org/data/definitions/71.html) _(Severity: High)_
- [CAPEC-73 — User-Controlled Filename](https://capec.mitre.org/data/definitions/73.html) _(Severity: High)_
- [CAPEC-120 — Double Encoding](https://capec.mitre.org/data/definitions/120.html) _(Severity: Medium)_
- [CAPEC-182 — Flash Injection](https://capec.mitre.org/data/definitions/182.html) _(Severity: Medium)_

## Referenzen

- <https://github.com/MarceloTessaro/promptcraft-forge-studio/security/advisories/GHSA-fjch-4g87-g4p4>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2025-58361/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_