Home » Database

AVID-2026-R1643

Description

Stored Cross-site Scripting (XSS) in wandb/openui (CVE-2025-0192)

Details

A stored Cross-site Scripting (XSS) vulnerability exists in the latest version of wandb/openui. The vulnerability is present in the edit HTML functionality, where an attacker can inject malicious scripts. When the modified HTML is shared with another user, the XSS payload executes, potentially leading to the theft of user prompt history and other sensitive information.

Reason for inclusion in AVID: The CVE targets wandb/openui, an AI experiment tracking/visualization tool commonly used in ML pipelines. It is a software vulnerability (stored XSS) in AI tooling, with potential data exfiltration from AI workflows. This is a software supply-chain component (dependency/tooling) used to build/train/deploy AI systems. The report provides clear CVE details, impact, CVSS, CWE, and references, giving sufficient evidence to classify as a vulnerability in the AI software supply chain.

References

Affected or Relevant Artifacts

  • Developer: wandb
  • Deployer: wandb
  • Artifact Details:
TypeName
Systemwandb/openui

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.0
Vector StringCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score5.4
Base Severity🟠 Medium
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges Required🟢 Low
User InteractionREQUIRED
ScopeCHANGED
Confidentiality Impact🟢 Low
Integrity Impact🟢 Low
Availability ImpactNONE

CWE

IDDescription
CWE-79CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2025-03-20
  • Version: 0.3.3
  • AVID Entry