The vulnerability CVE-2025-60068 affects javothemes Javo Core through version 3.0.0.266. It involves improper control over the generation of code, resulting in a code injection flaw. This allows an attacker to potentially inject malicious code remotely without authentication or user interaction, although the attack complexity is high. The vulnerability impacts confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. No patch or official remediation guidance is currently provided by the vendor, and the product is not a cloud service.

Successful exploitation could lead to limited confidentiality, integrity, and availability impacts due to code injection. The attacker could execute arbitrary code remotely, but the attack complexity is high and no privileges or user interaction are required. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor vendor communications for updates. In the meantime, restricting network access to the affected component and applying defense-in-depth controls may reduce exposure.