Vulnerabilities

TI-2025-39459 CVE-2025-63785 · GHSA-f2mq-8pqx-fqh5

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of…

MEDIUM 60

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00285 Published 2025-11-07 No fix listed CWE-116

TI-2025-39458 CVE-2025-63784 · GHSA-r4cg-5xmx-26h7

An Open Redirect vulnerability exists in the OAuth callback handler in file…

MEDIUM 62

An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00447 Published 2025-11-07 No fix listed CWE-601

TI-2025-39457 CVE-2025-63783 · GHSA-662x-h9f2-q6cg

A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC…

HIGH 66

A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web application 0.2.32.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00312 Published 2025-11-07 No fix listed CWE-20

Vulnerabilities

Filters

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of…

An Open Redirect vulnerability exists in the OAuth callback handler in file…

A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC…