MEDIUM5.4

GHSA-6qj9-2g9m-29x9

Tryton sao allows XSS because it does not escape completion values

Quick fix

GHSA-6qj9-2g9m-29x9 — tryton-sao: upgrade to the fixed version with the command below.

npm install tryton-sao@7.6.11

Details

Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/tryton-sao

Introduced in: 7.5.0Fixed in: 7.6.11

Fixnpm install tryton-sao@7.6.11

npm/tryton-sao

Introduced in: 7.1.0Fixed in: 7.4.21

Fixnpm install tryton-sao@7.4.21

npm/tryton-sao

Introduced in: 7.0.0Fixed in: 7.0.40

Fixnpm install tryton-sao@7.0.40

npm/tryton-sao

Introduced in: 0Fixed in: 6.0.69

Fixnpm install tryton-sao@6.0.69

References

https://nvd.nist.gov/vuln/detail/CVE-2025-66421[ADVISORY]
https://discuss.tryton.org/t/security-release-for-issue-14363/8951[WEB]
https://foss.heptapod.net/tryton/tryton/-/issues/14363[WEB]
https://github.com/tryton/sao[PACKAGE]