#cve Articles — wojtek

webAug 25, 2025

When Vue Forgets to Escape: From a Missing v-pre to Superadmin Takeover (Part II) - CVE-2025-64112

Part II of the CVE-2025-64112 writeup: weaponizing a stored XSS in the Statamic control panel into full Superadmin takeover. Admin-editable fields are rendered by Vue without v-pre or output encoding, so a {{constructor.constructor(...)}} payload executes JavaScript in a Superadmin's session. Two proof-of-concept chains are shown — a silent password change on versions ≤5.21.0, and an email swap on 5.22.0 (after password changes were hardened) to hijack the account via password reset.

#cve #research

Wojtek

Read

webJul 15, 2025

When Vue Forgets to Escape: Multiple Stored XSS Vectors Caused by Missing v-pre directive

Part I of the CVE-2025-64112 research: multiple stored XSS vectors in the Statamic control panel, rooted in Vue rendering admin-editable fields without the v-pre directive. Because Vue compiles mustache {{ }} expressions client-side, unescaped stored input is treated as executable template code — a {{this.constructor.constructor('alert(document.cookie)')()}} payload runs in an admin's browser. Six control-panel sections (collections, navigation, taxonomies, asset containers, globals, forms) were affected on versions ≤4.42.0. Part II chains this into full Superadmin takeover.

#cve #research

Wojtek

Read