PT-2026-1208 · Unknown · Zhanglun Lettura

Cranb3Rry · Publicado 2026-01-05 · Atualizado 2026-01-05 · CVE-2025-15454

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions zhanglun lettura versions up to 0.1.22

Description A security issue exists in zhanglun lettura affecting the RSS Handler component and specifically the processing within the src/components/ArticleView/ContentRender.tsx file. This issue results in cross site scripting, allowing for remote execution of attacks. The complexity of the attack is considered high, and exploitability is assessed as difficult. The exploit is publicly available.

Recommendations Apply patch 67213093db9923e828a6e3fd8696a998c85da2d4.

Exploit

Correção

XSS

Code Injection

Enumeração de Fraquezas

CWE-79

CWE-94

Identificadores relacionados

CVE-2025-15454

Produtos afetados

Zhanglun Lettura

Referências · 13

• 🔥 https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3#proof-of-concept · Exploit
• https://github.com/zhanglun/lettura/commit/67213093db9923e828a6e3fd8696a998c85da2d4 · Correção
• https://twitter.com/transilienceai/status/2008018861258383776 · Publicação no Twitter
• https://github.com/zhanglun/lettura · Nota
• https://osv.dev/vulnerability/CVE-2025-15454 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-15454 · Nota de Segurança
• https://vuldb.com/?ctiid.339487 · Nota
• https://vuldb.com/?id.339487 · Nota
• https://t.me/cveNotify/147669 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2008017764238131503 · Publicação no Twitter
• https://t.me/CVEtracker/41343 · Publicação no Telegram
• https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3 · Nota
• https://vuldb.com/?submit.725038 · Nota