PT-2025-139 · Foundry Gaming, LLC. · Foundry Virtual Tabletop
Олег Сурнин (Positive Technologies)
·
Published
2026-03-03
·
Updated
2026-03-03
CVSS v4.0
8.4
High
| CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:H/SA:H |
Name of the Vulnerable Software and Affected Versions
PT-2025-139: Stored Cross-Site Scripting (Stored XSS) in Foundry Virtual Tabletop
Description
A vulnerability has been identified in Foundry Virtual Tabletop affecting version 13.350. The discovered vulnerability can be exploited by an attacker to inject malicious JavaScript code into the client side of Foundry Virtual Tabletop (FVT) through unsafe handling of user input during rendering. When generating HTML templates or dynamic content, the server/client directly inserts the received data without proper sanitization, allowing the attacker to execute arbitrary scripts in the context of the victim's browser.
Vulnerability status: Confirmed by the vendor.
Vulnerability fix date: 11/12/2025.
Recommendations
Update to version 13.351 or higher.
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Foundry Virtual Tabletop