{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cwe-79/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:xxyopen:novel:3.5.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.1,"id":"CVE-2025-65442"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Novel (3.5.0)"],"_cs_severities":["low"],"_cs_tags":["xss","web-vulnerability","cwe-79"],"_cs_type":"advisory","_cs_vendors":["Xxyopen"],"content_html":"\u003cp\u003eCVE-2025-65442 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Xxyopen Novel version 3.5.0. The vulnerability stems from inadequate sanitization of user-submitted book comments. Malicious payloads stored in the database are retrieved by the application via an API, cached in the victim's browser local storage, and subsequently rendered directly into the DOM using the Vue 3 'v-html' directive without filtering. Successful exploitation allows for session cookie theft and impersonation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the target Novel platform with a legitimate account.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the book detail page and identifies the comment submission module.\u003c/li\u003e\n\u003cli\u003eAttacker submits a comment containing a malicious XSS payload (e.g., \u003ccode\u003e\u0026lt;svg onload=...\u0026gt;\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe application stores the unencoded malicious payload in the 'book_comment' database table.\u003c/li\u003e\n\u003cli\u003eA victim user navigates to the affected book detail or comment list page.\u003c/li\u003e\n\u003cli\u003eThe victim's browser fetches the comment list via the '/api/book/comment/list' endpoint.\u003c/li\u003e\n\u003cli\u003eThe front-end client stores the malicious content into 'window.localStorage' using the key 'book_comment_{bookId}'.\u003c/li\u003e\n\u003cli\u003eThe Vue 3 application renders the stored content directly into the DOM via 'v-html', triggering the execution of the injected script in the victim's browser session.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to unauthorized code execution within the victim's browser context. This allows attackers to potentially steal session cookies, perform actions on behalf of the victim, or tamper with the rendered content of the page.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Xxyopen Novel to a patched version once available from the vendor; currently, version 3.5.0 is the only confirmed affected version.\u003c/li\u003e\n\u003cli\u003eImplement strict output encoding and sanitization for all user-contributed content before rendering, specifically within Vue 3 components that utilize the 'v-html' directive.\u003c/li\u003e\n\u003cli\u003eReview and secure the API endpoints handling comment retrieval to ensure consistent server-side input validation and output encoding.\u003c/li\u003e\n\u003cli\u003eInspect application logs for anomalous requests to the '/api/book/comment/list' endpoint containing common XSS vectors or suspicious HTML tags.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-21T18:06:27Z","date_published":"2026-10-21T18:06:27Z","id":"https://feed.craftedsignal.io/briefs/2026-10-novel-xss/","summary":"Xxyopen Novel version 3.5.0 contains a DOM-based Cross-Site Scripting vulnerability in its comment module, allowing attackers to execute arbitrary JavaScript in the context of other users' sessions.","title":"Xxyopen Novel: DOM-based Cross-Site Scripting (CVE-2025-65442)","url":"https://feed.craftedsignal.io/briefs/2026-10-novel-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cwe-79","version":"https://jsonfeed.org/version/1.1"}