VaultDweller Leyka versions up to 3.32.1 are affected by a DOM-based cross-site scripting vulnerability caused by improper input neutralization during web page generation. This vulnerability (CVE-2025-53275) allows an attacker with low complexity and requiring user interaction to inject malicious scripts, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.5, reflecting a medium severity level. The vulnerability is not related to cloud services and no vendor advisory or patch information is currently available.

Successful exploitation of this DOM-based XSS vulnerability can lead to limited confidentiality, integrity, and availability impacts within the affected VaultDweller Leyka application. The attacker requires some privileges and user interaction to exploit this issue. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply best practices for mitigating DOM-based XSS vulnerabilities, such as input validation and output encoding where possible within their environment. Monitor vendor communications for updates regarding patches or official mitigations.