Security Digest: December 4, 2025 - 3 Critical Vulnerabilities

Three critical vulnerabilities have been identified that require immediate attention. Developers and security teams must act quickly to secure systems against potential exploits.

· 3 min read

Today's Top Security Threats

Three critical vulnerabilities have been identified that require immediate attention. Developers and security teams must act quickly to secure systems against potential exploits.

Critical Vulnerabilities

CVE-2025-65959: Stored XSS in Open-WebUI Notes PDF

  • Impact: Allows attackers to execute arbitrary JavaScript and steal session tokens.
  • Affected Systems: Open-WebUI v0.6.36 using Notes feature.
  • Immediate Action: Apply DOMPurify sanitization in the PDF generation code.
  • Mitigation: Update code to use DOMPurify with specified allowed tags and attributes.

CVE-2025-65958: SSRF Vulnerability in Open-WebUI

  • Impact: Enables authenticated users to make unauthorized HTTP requests to internal and cloud metadata endpoints.
  • Affected Systems: Open-WebUI using /api/v1/retrieval/process/web endpoint.
  • Immediate Action: Implement URL validation to block private and sensitive ranges.
  • Mitigation: Apply filters for IP ranges and protocols in the request handling code.

CVE-2025-65945: Improper Signature Verification in auth0/node-jws

  • Impact: Allows bypassing signature verification under specific conditions.
  • Affected Systems: Applications using auth0/node-jws versions <=3.2.2 or 4.0.0 with HS256.
  • Immediate Action: Upgrade to auth0/node-jws version 3.2.3 or 4.0.1.
  • Mitigation: Ensure no user data is used in HMAC secret lookup routines.

What to Do Now

  1. Patch affected systems immediately with the latest updates.
  2. Verify sanitization and validation processes in code.
  3. Monitor for unusual activity or unauthorized access attempts.

Related Resources

  • Open-WebUI Advisory: [Link to official advisory]
  • auth0/node-jws Release Notes: [Link to update details]

Keep reading