This vulnerability (CVE-2025-64999) in Checkmk involves improper input neutralization during web page generation, specifically in Synthetic Monitoring HTML logs. An attacker with the ability to manipulate a host's check output can inject malicious JavaScript code, leading to a cross-site scripting (CWE-79) issue. The vulnerability affects Checkmk versions 2.4.0 prior to 2.4.0p22 and 2.3.0 prior to 2.3.0p43. Exploitation requires low privileges and user interaction, and the impact includes high confidentiality, integrity, and availability consequences as per the CVSS 4.0 vector. No cloud service is involved, and no known exploits have been reported.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when they access the maliciously crafted Synthetic Monitoring HTML logs via a phishing link. This can lead to theft of sensitive information, session hijacking, or other malicious actions within the affected web application context. The CVSS 4.0 score of 7.3 indicates a high severity with significant impact on confidentiality, integrity, and availability. However, exploitation requires the attacker to have at least low privileges to manipulate host check output and requires user interaction.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Since no official patch links are provided in the data, users should monitor Checkmk GmbH advisories for updates and apply any official patches or updates once available. Until a patch is applied, limit the ability of untrusted users to manipulate host check outputs and educate users to be cautious with phishing links that may lead to Synthetic Monitoring HTML logs.