PT-2025-26621 · Unknown+1 · Visionatrix+1

Protozeit · Published 2025-06-23 · Updated 2025-06-23 · CVE-2025-49126

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Visionatrix versions 1.5.0 through 2.5.0

Description: The issue concerns a Reflected XSS (Cross-Site Scripting) attack via the "/docs/flows" endpoint, allowing full takeover of the application and exfiltration of secrets stored in the application. This is due to the use of the get swagger ui html function from FastAPI, which does not encode or sanitize its arguments before generating the HTML for the swagger documentation page. Any user of this application can be targeted with a one-click attack that can takeover their session and all the secrets that may be contained within it.

Recommendations: For versions 1.5.0 through 2.5.0, update to version 2.5.1 to resolve the issue. As a temporary workaround, consider restricting access to the "/docs/flows" endpoint until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-49126

GHSA-W36R-9JVX-Q48V

Affected Products

Fastapi

Visionatrix

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49126.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-49126 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49126 · Vendor Advisory
• https://github.com/Visionatrix/Visionatrix/commit/63aafe6e4d1bffe4bf69e73b6fdfc65c71a8f5b8 · Note
• https://github.com/Visionatrix/Visionatrix · Note
• https://github.com/Visionatrix/Visionatrix/security/advisories/GHSA-w36r-9jvx-q48v · Note
• https://twitter.com/CVEnew/status/1937207100725137758 · Twitter Post
• https://twitter.com/CveFindCom/status/1937204132844081651 · Twitter Post
• https://t.me/cvetracker/26860 · Telegram Post
• https://t.me/latest_high_impact_cve/2786 · Telegram Post