PT-2026-3106 · Unknown · Sparkyfitness

Published 2026-01-15 · Updated 2026-01-17 · CVE-2025-65368

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SparkyFitness version 0.15.8.2

Description SparkyFitness is susceptible to Cross-Site Scripting (XSS) attacks. The issue stems from improper handling of user input and output from Large Language Models (LLMs). This allows for the injection of malicious scripts into web pages viewed by other users.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider sanitizing all user input and LLM output before rendering it in web pages.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-65368

GHSA-J7X6-6678-2XQP

Affected Products

Sparkyfitness

References · 6

• https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-j7x6-6678-2xqp#event-521570 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65368 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65368 · Vendor Advisory
• https://github.com/CodeWithCJ/SparkyFitness · Note
• https://twitter.com/CVEnew/status/2012490384308363696 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2011976812385996909 · Twitter Post