CVE-2025-23908 describes a stored cross-site scripting vulnerability in Rami Yushuvaev's Pastebin product, specifically in the pastebin-embed functionality. The vulnerability is due to improper neutralization of input during web page generation, which allows malicious scripts to be stored and executed when other users view the affected pages. It affects Pastebin versions up to 1.5. The CVSS 3.1 base score is 6.5, reflecting a network attack vector, low attack complexity, requiring low privileges and user interaction, with impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits exist in the wild.

An attacker with low privileges can inject malicious scripts that are stored and executed in the context of other users viewing the affected Pastebin pages. This can lead to limited confidentiality loss, integrity compromise, and availability disruption. The vulnerability requires user interaction and is exploitable over the network. No evidence of active exploitation is reported.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected Pastebin versions or applying input sanitization controls if possible. Monitor vendor channels for updates and apply patches promptly once released.