A vulnerability was detected in zhanglun lettura up to 0.1.22. This issue affects some unknown processing of the file src/components/ArticleView/ContentRender.tsx of the component RSS Handler. The manipulation results in cross site scripting. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used. The patch is identified as 67213093db9923e828a6e3fd8696a998c85da2d4. It is best practice to apply a patch to resolve this issue.

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00036.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Zhanglun
  • Lettura

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Zhanglun
  • Lettura
References
Link Providers
https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3 cve-icon cve-icon
https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3#proof-of-concept cve-icon cve-icon
https://github.com/zhanglun/lettura/commit/67213093db9923e828a6e3fd8696a998c85da2d4 cve-icon cve-icon
https://vuldb.com/?ctiid.339487 cve-icon cve-icon
https://vuldb.com/?id.339487 cve-icon cve-icon
https://vuldb.com/?submit.725038 cve-icon cve-icon
History

Tue, 06 Jan 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Zhanglun
Zhanglun lettura
Vendors & Products Zhanglun
Zhanglun lettura

Mon, 05 Jan 2026 03:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in zhanglun lettura up to 0.1.22. This issue affects some unknown processing of the file src/components/ArticleView/ContentRender.tsx of the component RSS Handler. The manipulation results in cross site scripting. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used. The patch is identified as 67213093db9923e828a6e3fd8696a998c85da2d4. It is best practice to apply a patch to resolve this issue.
Title zhanglun lettura RSS ContentRender.tsx cross site scripting
Weaknesses CWE-79
CWE-94
References
Metrics cvssV2_0

{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.1, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-01-06T18:54:30.494Z

Reserved: 2026-01-04T08:57:15.895Z

Link: CVE-2025-15454

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-01-05T03:15:50.477

Modified: 2026-01-05T03:15:50.477

Link: CVE-2025-15454

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-01-06T14:17:48Z