XSS in Dolfinus 3dalloy
CVE-2025-59332
3DAlloy is a lightWeight 3D-viewer for MediaWiki. From 1.0 through 1.8, the <3d> parser tag and the {{#3d}} parser function allow users to provide custom attributes that are then appended to the canvas HTML element that is being output by the extension. The attributes are not sanitized, which means that arbitrary JavaScript can be inserted and executed.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (31.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.
Affected products
- Dolfinus 3dalloy — versions >= 1.0, <= 1.8
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-59332?
- CVE-2025-59332 is a high-severity vulnerability in Dolfinus 3dalloy, classified under Cross-site Scripting. CVSS score: 8.6/10. Published 2025-09-15.
- How severe is CVE-2025-59332?
- High severity. CVSS v3 base score is 8.6 out of 10.
- Is CVE-2025-59332 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.