CVE-2025-29512 is a Cross-Site Scripting (XSS) vulnerability affecting NodeBB versions up to and including 4.0.4. It permits remote attackers to inject and store arbitrary code, which may render the blacklist IP feature unusable until the injected content is manually removed from the database. The vulnerability has a CVSS 3.1 base score of 6.1, indicating a medium severity level. There is no official remediation or patch currently documented, and no known exploits in the wild have been reported.

The vulnerability allows remote attackers to execute stored XSS attacks by injecting arbitrary code into NodeBB instances up to version 4.0.4. This can lead to partial compromise of confidentiality and integrity, specifically affecting the blacklist IP functionality by making it unusable until the malicious content is cleared from the database. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider manual removal of malicious content from the database to restore blacklist IP functionality. Monitor vendor communications for updates on patches or official mitigations.