CVE-2025-21088

Source
https://nvd.nist.gov/vuln/detail/CVE-2025-21088
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21088.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-21088
Aliases
Downstream
Related
Published
2025-01-15T16:15:32Z
Modified
2025-10-02T05:51:29.660497Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the frontend via crafted malicious input.

References

Affected packages

Git / github.com/mattermost/mattermost

Affected ranges

Type
GIT
Repo
https://github.com/mattermost/mattermost
Events
Type
GIT
Repo
https://github.com/mattermost/mattermost-server
Events

Affected versions

@mattermost/client@10.*

@mattermost/client@10.0.0

@mattermost/client@9.*

@mattermost/client@9.11.0

@mattermost/types@10.*

@mattermost/types@10.0.0

@mattermost/types@9.*

@mattermost/types@9.11.0

v10.*

v10.0.0
v10.0.0-rc4
v10.0.1
v10.0.1-rc1
v10.0.2
v10.0.2-rc1
v10.0.2-rc2
v10.0.3
v10.0.3-rc1
v10.0.4-rc1
v10.0.4-rc2

v9.*

v9.11.0
v9.11.0-rc3
v9.11.1
v9.11.1-rc1
v9.11.2
v9.11.2-rc1
v9.11.2-rc2
v9.11.3
v9.11.3-rc1
v9.11.3-rc2
v9.11.4
v9.11.4-rc1
v9.11.5
v9.11.5-rc1
v9.11.6-rc1
v9.11.6-rc2