CVE-2025-59332CWE-79

3DAlloy allows stored XSS through attributes provided to the 3d parser tag/function

High · published September 15, 2025

CVSS v3.1
8.6
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

3DAlloy is a lightWeight 3D-viewer for MediaWiki. From 1.0 through 1.8, the <3d> parser tag and the {{#3d}} parser function allow users to provide custom attributes that are then appended to the canvas HTML element that is being output by the extension. The attributes are not sanitized, which means that arbitrary JavaScript can be inserted and executed.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00378 · 30.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-09-15T20:06Z
EPSS history
Timeline
  • 15 SEP 20:06Z
    3DAlloy allows stored XSS through attributes provided to the 3d parser tag/function
    cvelistv5