PT-2025-45471 · Onelook · Onlook

Published 2025-11-07 · Updated 2025-11-07 · CVE-2025-63785

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Onlook versions 0.2.32

Description A DOM-based Cross-Site Scripting (XSS) issue exists in the text editor feature. The problem arises because user-supplied input is not properly sanitized before being injected into the DOM via innerHTML when editing a text element. An attacker can inject malicious HTML and script code, which is then executed within the context of the preview iframe, allowing for the execution of arbitrary scripts in the user's session.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Improper Encoding or Escaping of Output

XSS

RCE

Weakness Enumeration

CWE-116

CWE-79

CWE-20

Related Identifiers

CVE-2025-63785

Affected Products

Onlook

References · 5

• 🔥 https://blog.soohyun.tech/CVE-2025-63785-DOM-XSS-in-Onlook-27e557175d2e80e1b210c75b77952115 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63785 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63785 · Vendor Advisory
• https://tossbank.notion.site/DOM-XSS-in-onlook-27e557175d2e80e1b210c75b77952115 · Note
• https://t.me/cveNotify/142132 · Telegram Post