PT-2025-43408 · Vdo.Ninja · Vdo.Ninja

Published 2025-10-22 · Updated 2026-02-26 · CVE-2025-62613

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions VDO.Ninja versions 28.0 through 28.3

Description VDO.Ninja is a tool used to integrate remote video feeds into studio software via WebRTC. A reflected Cross-Site Scripting (XSS) issue exists in the examples/control.html file through the room parameter. The application does not properly sanitize input before rendering it in the Document Object Model (DOM), which allows for the injection and execution of malicious scripts.

Recommendations Update to version 28.4 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62613

GHSA-MP9C-CPCH-X73C

Affected Products

Vdo.Ninja

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62613.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62613 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62613 · Vendor Advisory
• https://github.com/steveseguin/vdo.ninja/releases/tag/v28.4 · Note
• https://github.com/steveseguin/vdo.ninja/commit/83c0ac753ad60c7a086daced3244688cabd4f6b8 · Note
• https://github.com/steveseguin/vdo.ninja/security/advisories/GHSA-mp9c-cpch-x73c · Note
• https://twitter.com/pdnuclei_bot/status/2026945365275210205 · Twitter Post
• https://twitter.com/CVEnew/status/1981219899901956387 · Twitter Post
• https://t.me/cveNotify/140446 · Telegram Post
• https://t.me/CVEtracker/35525 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1981115726208331983 · Twitter Post