CVE-2025-6623
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
29/100
Published: 2026-10-19
Modified: 2026-11-04
First seen: 2026-11-04
Status: active
Attack Surface
Adjacent
Low Complexity
Scope Change
CVSS Vector Breakdown
AV:
Adjacent
AC:
Low
PR:
High
UI:
Required
S:
Changed
C:
Low
I:
Low
A:
None
Description
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.