Read the docs
TI-2025-02634 Aliases CVE-2025-3019GHSA-4c3m-33r2-8r8w

Cross-site scripting vulnerabilities in KNIME Business Hub web pages

Priority LOW 30CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opens a malicious web page, arbitrary Java Script may be executed with this user's permissions. This can lead to information loss and/or modification of existing data. The issues are caused by a bug https://github.com/Baroshem/nuxt-security/issues/610 in the widely used nuxt-security module. There are no viable workarounds therefore we strongly recommend to update to one of the following versions of KNIME Business Hub: * 1.13.3 or later * 1.12.4 or later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00272 19th percentileScored 2026-11-07
Fix Fixed KNIME Business Hub (KNIME): 1.13.3, 1.12.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KNIMEKNIME Business Hub1.13.0 to before 1.13.3; 1.12.0 to before 1.12.41.13.3, 1.12.4Patch availableCNA
  • KNIME Business Hub VendorKNIME Affected 1.13.0 to before 1.13.3; 1.12.0 to before 1.12.4 Fixed in 1.13.3, 1.12.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:knime:business_hub:*:*:*:*:*:*:*:*before 1.12.4; 1.13.0 to before 1.13.3VulnerableKNIME
  • cpe:2.3:a:knime:business_hub:*:*:*:*:*:*:*:* Versions before 1.12.4; 1.13.0 to before 1.13.3 Vulnerable ·KNIME

Remediation

  • Fix · CNA KNIME Business Hub (KNIME) Fixed in 1.13.3, 1.12.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-3019
  2. 2026-10-03 Alias added: GHSA-4c3m-33r2-8r8w

References

Advisory 1

  • TI-2025-02116 Hard-coded password for object store of KNIME Business Hub CVSS 4.0HIGH 8.8
  • TI-2025-02436 Ingress-nginx vulnerability in KNIME Business Hub CVSS 4.0HIGH 8.7
  • TI-2024-06119 Denial-of-service on KNIME Business Hub when certain jobs are executed CVSS 4.0HIGH 7.1
  • TI-2023-02376 Sensitive information disclosure in KNIME Hub Web Application CVSS 3.1MEDIUM 5.3
  • TI-2025-10293 Open redirect vulnerability in KNIME Business Hub CVSS 4.0MEDIUM 5.3
  • TI-2025-13035 Jobs can be saved as workflows with wrong permissions on KNIME Business Hub CVSS 4.0MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences