Cyber Posture

CVE-2025-0747

High

Published: 30 January 2025

Published
30 January 2025
Modified
08 October 2025
KEV Added
Patch
CVSS Score 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS Score 0.0009 25.7th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse various implementations of JavaScript for execution.

Security Summary

CVE-2025-0747 is a Stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, affecting EmbedAI. Published on 2025-01-30, it carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). The issue enables injection of malicious JavaScript code into a message within the application.

An authenticated attacker can exploit this vulnerability by injecting malicious JavaScript into a message, which executes in the context of another user's browser when they open the chat. This leads to high-impact confidentiality violations through cross-origin data exfiltration, leveraging the changed scope.

Mitigation details are available in the INCIBE-CERT advisory on multiple vulnerabilities in EmbedAI at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai.

Details

CWE(s)
CWE-79

Affected Products

thesamur
embedai
≤ 2.1

AI Security Analysis

AI Category
Enterprise AI Assistants
Risk Domain
Other ATLAS/OWASP Terms
OWASP Top 10 for LLMs 2025
None mapped
MITRE ATLAS Techniques
None mapped
Classification Reason
EmbedAI is a tool for creating chatbots, which are AI-powered conversational agents fitting the Enterprise AI Assistants category.

MITRE ATT&CK Enterprise Techniques

T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

Stored XSS allows authenticated attackers to inject arbitrary JavaScript into chat messages, enabling execution in victims' browsers upon viewing the chat (Command and Scripting Interpreter: JavaScript).

References