CVE-2025-58232 describes a DOM-based Cross-site Scripting vulnerability in the Ickata Image Editor by Pixo, present in versions up to 2.3.8. The issue stems from improper neutralization of input during web page generation, which can allow an attacker to inject and execute arbitrary scripts in the context of the affected application. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and impacts on confidentiality, integrity, and availability at a low level. The vulnerability is published and assigned by Patchstack but lacks vendor patch or advisory details.

Successful exploitation could allow an attacker to execute arbitrary scripts in the victim's browser context, potentially leading to partial confidentiality, integrity, and availability impacts. The attack requires user interaction and low privileges, limiting the ease of exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider implementing additional input validation or content security policies where possible. Monitor vendor channels for updates regarding patches or official mitigations.