Read the docs
TI-2025-41409 Aliases CVE-2025-67712GHSA-79v5-g3qw-x5vg

HTML injection issue in ArcGIS Web App Builder

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

There is an HTML injection issue in Esri ArcGIS Web AppBuilder developer edition versions prior to 2.30 that allows a remote, unauthenticated attacker to potentially entice a user to click a link that causes arbitrary HTML to render in a victim's browser. There is no evidence of JavaScript execution, which limits the impact. At the time of submission, ArcGIS Web App Builder developer edition is retired and unsupported. ArcGIS Web App Builder 2.30 is not susceptible to this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00332 26th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EsriArcGIS Web AppBuilder {Developer Edition)all – 2.30—No fix listedCNA
  • ArcGIS Web AppBuilder {Developer Edition) VendorEsri Affected all – 2.30 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-67712
  2. 2026-10-03 Alias added: GHSA-79v5-g3qw-x5vg

References

Other 1

  • TI-2024-16901 Portal for ArcGIS has a directory traversal vulnerability. CVSS 3.1CRITICAL 9.9
  • TI-2012-01450 ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before… CVSS 2.0HIGH 9.3
  • TI-2007-01695 Buffer overflow in the ArcSDE service (giomgr) in Environmental Systems Research… CVSS 2.0HIGH 10.0
  • TI-2026-08070 Directory Traversal in ArcGIS Server CVSS 3.1CRITICAL 9.8
  • TI-2026-11074 Missing authentication in Esri Portal for ArcGIS CVSS 3.1CRITICAL 9.8
  • TI-2025-35724 BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services. CVSS 3.1CRITICAL 10.0
See all 194 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences