CVE-2025-9913
MediumCVSS 4.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
JavaScript can be executed inside the address bar via the dashboard "Open in new Tab" button, making the application vulnerable to session hijacking.
Risk Assessment
An attacker could hijack a user's session, leading to unauthorized account access and actions performed on behalf of the victim.
Recommendation
Update the application to a version that fixes the JavaScript injection through the "Open in new Tab" button.
Other vulnerabilities in Dashboard
See all- CVE-2026-12593High
An internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) failed to enforce sufficient permissions when creating an API token for another user. An attacker knowing the login name of a privileged internal user and authenticated via OAuth/OIDC could forge a token creation request on their behalf.
- CVE-2026-42127High
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion.
- CVE-2026-33377High
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to escalate privilege.
Original NVD description (English source)
JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS