PT-2025-48541 · Doit · Todoist

Published 2025-12-01 · Updated 2025-12-02 · CVE-2025-63317

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Todoist version 8896

Description Todoist version 8896 has a Cross Site Scripting (XSS) issue in the /api/v1/uploads API endpoint. Uploaded SVG files lack sanitization, allowing embedded JavaScript to execute when a user opens the attachment from a task or comment. The vulnerable parameter is the SVG file itself.

Recommendations Apply sanitization to uploaded SVG files to prevent the execution of embedded JavaScript.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-63317

Affected Products

Todoist

References · 6

• 🔥 https://github.com/sefabasnak/Todoistv8896 · Exploit
• https://osv.dev/vulnerability/CVE-2025-63317 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63317 · Security Note
• https://t.me/CVEtracker/38574 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1995737622862307800 · Twitter Post
• https://twitter.com/CVEnew/status/1995581642040074448 · Twitter Post