GHSA-hg3j-6pmh-mvjr

Source

https://github.com/advisories/GHSA-hg3j-6pmh-mvjr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-hg3j-6pmh-mvjr/GHSA-hg3j-6pmh-mvjr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hg3j-6pmh-mvjr

Aliases

CVE-2025-56514

Published

2025-10-01T18:30:38Z

Modified

2025-10-13T15:19:42Z

Severity

2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P CVSS Calculator

Summary

Fiora chat user avatar is vulnerable to XSS via SVG files

Details

Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows arbitrary JavaScript execution when malicious SVG files are rendered by other users.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-01T20:49:32Z",
    "nvd_published_at": "2025-10-01T16:15:53Z",
    "severity": "LOW"
}

References

Affected packages

npm / fiora

Package

Name: fiora; View open source insights on deps.dev
Purl: pkg:npm/fiora

Affected ranges

Affected versions

1.*

1.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-hg3j-6pmh-mvjr/GHSA-hg3j-6pmh-mvjr.json"