PT-2025-18070 · Unknown · Web-Arena-X

Ybdesire · Published 2025-04-28 · Updated 2025-05-14 · CVE-2025-4022

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions web-arena-x webarena versions up to 0.2.0

Description A critical issue has been found, affecting the function HTMLContentEvaluator of the file webarena/evaluation harness/evaluators.py. The manipulation of the argument target["url"] leads to code injection. This issue can be exploited remotely. The exploit has been publicly disclosed and may be used.

Recommendations For versions up to 0.2.0, as a temporary workaround, consider disabling the HTMLContentEvaluator function until a patch is available. Restrict access to the evaluators.py file to minimize the risk of exploitation. Avoid using the target["url"] argument in the affected function until the issue is resolved.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2025-4022

Affected Products

Web-Arena-X

References · 12

• 🔥 https://github.com/web-arena-x/webarena/issues/194 · Exploit
• 🔥 https://github.com/web-arena-x/webarena/issues/194#issuecomment-2796165922 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-4022 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4022 · Vendor Advisory
• https://twitter.com/CVEnew/status/1916853633569694064 · Twitter Post
• https://twitter.com/dailycve/status/1922765253059727368 · Twitter Post
• https://vuldb.com/?submit.558415 · Note
• https://t.me/cvedetector/23909 · Telegram Post
• https://vuldb.com/?ctiid.306376 · Note
• https://vuldb.com/?id.306376 · Note
• https://t.me/cvetracker/22527 · Telegram Post
• https://t.me/cvenotify/122212 · Telegram Post