CVE-2025-13584

Vulnerability

Analysis

CVE-2025-13584 is a stored cross-site scripting (XSS) vulnerability affecting the Description Handler component of Eigenfocus up to version 1.4.0. The root cause is insufficient sanitization of user-supplied input: the entry.description and time_entry.description argument is not properly escaped before being rendered in the browser. This allows an attacker to inject arbitrary HTML or JavaScript code that is stored on the server and executed when other users view the affected time entry [1][2].

Exploitation

Attackers can exploit this vulnerability remotely without requiring authentication, as the issue lies in the input handling for time entry descriptions. A proof-of-concept payload is provided: `` entered into the time entry description field. When the entry is opened in edit mode, the stored payload triggers execution of the JavaScript [4]. The attack is considered low severity (CVSS 3.1/3.5) because it requires user interaction (viewing the entry) and does not directly compromise server integrity.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the Eigenfocus application in the victim's browser. This can lead to session hijacking, account compromise, and other unauthorized actions, such as exfiltration of sensitive data or performing actions on behalf of the victim [4]. The vulnerability is stored, meaning the payload persists and affects all users who view the compromised the entry [1].

Mitigation

The vulnerability is fixed in version 1.4.1, which was released to address the HTML escaping issue in autoresizable textareas [3]. The fix commit 7dec94c9d1f3e513e0ee38ba68caaba628e08582 applies proper escaping to time entry descriptions [2]. Users are strongly advised to upgrade to version 1.4.1 or later. There are no known workarounds for unpatched versions.