GHSA-2c6j-vw6r-mfch

Source

https://github.com/advisories/GHSA-2c6j-vw6r-mfch

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-2c6j-vw6r-mfch/GHSA-2c6j-vw6r-mfch.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2c6j-vw6r-mfch

Aliases

CVE-2025-56515

Published

2025-10-01T18:30:38Z

Modified

2025-10-01T21:12:33.510329Z

Severity

2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P CVSS Calculator

Summary

Fiora chat group avatar is vulnerable to XSS via SVG files

Details

File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers (onmouseover) to be uploaded and stored. When rendered, these SVG files execute arbitrary JavaScript, enabling attackers to steal user sessions, cookies, and perform unauthorized actions in the context of users viewing affected profiles.

Database specific

{
    "nvd_published_at": "2025-10-01T16:15:53Z",
    "severity": "LOW",
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed_at": "2025-10-01T20:57:52Z",
    "github_reviewed": true
}

References

Affected packages

npm / fiora

Package

Name: fiora; View open source insights on deps.dev
Purl: pkg:npm/fiora

Affected ranges

Affected versions

1.*

1.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-2c6j-vw6r-mfch/GHSA-2c6j-vw6r-mfch.json"