PT-2026-1208 · Unknown · Zhanglun Lettura

Cranb3Rry · Published 2026-01-05 · Updated 2026-01-05 · CVE-2025-15454

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions zhanglun lettura versions up to 0.1.22

Description A security issue exists in zhanglun lettura affecting the RSS Handler component and specifically the processing within the src/components/ArticleView/ContentRender.tsx file. This issue results in cross site scripting, allowing for remote execution of attacks. The complexity of the attack is considered high, and exploitability is assessed as difficult. The exploit is publicly available.

Recommendations Apply patch 67213093db9923e828a6e3fd8696a998c85da2d4.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-15454

Affected Products

Zhanglun Lettura

References · 13

• 🔥 https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3#proof-of-concept · Exploit
• https://github.com/zhanglun/lettura/commit/67213093db9923e828a6e3fd8696a998c85da2d4 · Patch
• https://osv.dev/vulnerability/CVE-2025-15454 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15454 · Security Note
• https://twitter.com/transilienceai/status/2008018861258383776 · Twitter Post
• https://github.com/zhanglun/lettura · Note
• https://vuldb.com/?ctiid.339487 · Note
• https://vuldb.com/?id.339487 · Note
• https://t.me/cveNotify/147669 · Telegram Post
• https://twitter.com/CVEnew/status/2008017764238131503 · Twitter Post
• https://t.me/CVEtracker/41343 · Telegram Post
• https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3 · Note
• https://vuldb.com/?submit.725038 · Note