CVE-2025-58353HIGH 8.2EPSS p12.9%

CVE-2025-58353CVE-2025-58353

Description

Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions of Promptcraft Forge Studio sanitize user input using regex blacklists such as r`eplace(/javascript:/gi, '')`. Because the package uses multi-character tokens and each replacement is applied only once, removing one occurrence can create a new dangerous token due to overlap. The “sanitized” value may still contain an executable payload when used in href/src (or injected into the DOM). There is currently no fix for this issue.

Scoring

CVSS 3.18.2 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
EPSS0.22% probability of exploitation · percentile 12.9% · 2026-06-19T12:03:05Z
Published2025-09-04
Last modified2026-04-15

Underlying weaknesses· 3

CWE-20CWE-79CWE-184

References

  1. https://github.com/MarceloTessaro/promptcraft-forge-studio/security/advisories/GHSA-mv25-7v95-q3pf

3

TypeTargetConfidenceTier
WeaknessIncomplete List of Disallowed Inputscwe-1840%live
WeaknessImproper Input Validationcwe-200%live
WeaknessImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')cwe-790%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-58361
CVE
CVE-2025-58357
CVE
CVE-2025-45150
CVE
CVE-2025-55319
CVE
CVE-2025-25362
CVE
CVE-2026-5760
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.