CVE-2025-65442: novel · DOM-based Cross-Site Scripting (XSS)
Affects novelSource CVE Database V5
Not known to be exploited · CVSS 6.1 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 28% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 29 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHub201206030/novelpkg:github/201206030/novelOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
To mitigate CVE-2025-65442, organizations should implement strict input validation and output encoding for all user-controllable data, especially within the book comment module. Specifically, avoid using Vue 3's v-html directive to render untrusted content; instead, use safer rendering methods that automatically escape HTML or employ robust sanitization libraries such as DOMPurify to cleanse input before storage and rendering. Review and sanitize any data stored in window.localStorage before usage. Implement Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts and reduce the impact of XSS attacks. Conduct thorough code audits focusing on client-side rendering logic and API responses to ensure no unsanitized data is injected into the DOM. Educate users to be cautious about clicking suspicious links, and monitor web application logs for unusual parameter usage or injection attempts. Finally, maintain an incident response plan to quickly address any exploitation attempts once patches or updates become available from the vendor.
Description
DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information (e.g., user session cookies) via a crafted "wvstest" parameter in the URL or malicious script injection into window.localStorage. The vulnerability arises from insufficient validation and encoding of user-controllable data in the book comment module: unfiltered user input is stored in the backend database (book_comment table, commentContent field) and returned via API, then rendered directly into the page DOM via Vue 3's v-html directive without sanitization. Even if modern browsers' built-in XSS filters block pop-up alerts, attackers can use concealed payloads to bypass interception and achieve actual harm.