What is GHSA-4g25-wj72-chxg?

GHSA-4g25-wj72-chxg is a security advisory published by GitHub Security Advisories with Medium severity. Snipe-IT allows stored XSS via the Locations "Country" field

Which CVE IDs does GHSA-4g25-wj72-chxg cover?

GHSA-4g25-wj72-chxg covers the following CVE IDs: CVE-2025-65622. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-4g25-wj72-chxg?

GHSA-4g25-wj72-chxg affects 1 product, including: composer/snipe/snipe-it:\u003c 8.3.4.

GHSA-4g25-wj72-chxgMedium

Snipe-IT allows stored XSS via the Locations "Country" field

Vendor

GitHub Security Advisories

Published

December 2, 2025

Last Modified

December 3, 2025

🔗 CVE IDs covered (1)

CVE-2025-65622 →

📋 Description

Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.

🎯 Affected products1

composer/snipe/snipe-it:< 8.3.4

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2025-65622
https://github.com/firef0x00/vulnerability-research/tree/main/CVE-2025-65622
http://snipeitapp.com
https://github.com/grokability/snipe-it/commit/23feb64b5ab3d92eb8755da41049ac43a3d0e05b
https://github.com/grokability/snipe-it/releases/tag/v8.3.4
https://github.com/advisories/GHSA-4g25-wj72-chxg