CVE-2025-63885

MediumCVSS 6.1

Published: 30/10/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

A stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the model_desc field.

Risk Assessment

An attacker could execute malicious code in a user's browser, potentially leading to session theft or content modification.

Recommendation

Apply the vendor fix or properly validate and encode input in the model_desc field.

Other vulnerabilities in AIxBlock

CVE-2025-60950Medium
An arbitrary file upload vulnerability exists in the Data Preparation function of AIxBlock commit f60975. Attackers can upload a crafted SVG file to execute arbitrary code.

Original NVD description (English source)

A stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the model_desc field.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS