CVE-2025-64177: ThinkDashboard: Stored XSS in Dashboard via Malicious Bookmark

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-11-06 · updated 2026-06-17
Weakness: CWE-79

Description

ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, there is a stored Cross-Site Scripting (XSS) vulnerability in the dashboard, which can exploited when a user clicks on a malicious bookmark, made vulnerable by the lack of scheme filtering. This is fixed in version 0.6.8.

Affected products

MatiasDesuu ThinkDashboard: before 0.6.8 — fixed in 0.6.8

How to fix

Upgrade to a fixed version: MatiasDesuu ThinkDashboard 0.6.8. Check the vendor advisory for mitigations.

References

https://github.com/MatiasDesuu/ThinkDashboard/commit/16976263b22a4b0526b2c7c30294cc099258edae
https://github.com/MatiasDesuu/ThinkDashboard/security/advisories/GHSA-57f2-rhxm-fjv3

Get alerted when CVE-2025-64177 or the next vulnerability affects your stack