PT-2025-14115 · Unknown+1 · React-Tooltip+1

Published 2025-04-01 · Updated 2025-09-23 · CVE-2025-30210

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Bruno versions prior to 1.39.1

Description The issue arises from custom tool-tip components using react-tooltip, which set content as raw HTML and inject it into the DOM on hover. This, combined with loose Content Security Policy restrictions, allows execution of any valid HTML text containing inline script when hovering over an Environment's name. The attack surface is limited to scenarios where users import collections from untrusted sources. The exploit requires user action, specifically downloading and opening a malicious collection export and hovering over the environment name.

Recommendations For versions prior to 1.39.1, update to version 1.39.1 to fix the issue. As a temporary workaround, consider avoiding the import of collections from untrusted or malicious sources, and restrict the use of custom tooltips until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2025-30210

GHSA-FQXC-CXPH-9VQ8

Affected Products

Bruno

React-Tooltip

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30210.json · Exploit
• https://github.com/usebruno/bruno/security/advisories/GHSA-fqxc-cxph-9vq8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30210 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30210 · Vendor Advisory
• https://t.me/cveNotify/136185 · Telegram Post
• https://twitter.com/CveFindCom/status/1907078521257623933 · Twitter Post
• https://twitter.com/CVEnew/status/1908663691542966368 · Twitter Post