GetmeUK ContentTools Image cross site scripting

Description

CVE-2025-2699 is a stored cross-site scripting (XSS) vulnerability in GetmeUK ContentTools, a JavaScript library for building WYSIWYG editors, version 1.6.16 and earlier. The flaw resides in an unknown function of the Image Handler component, where the onload argument is improperly sanitized, allowing an attacker to inject arbitrary JavaScript through image elements [1][3].

Exploitation

An attacker can remotely exploit this vulnerability by injecting a malicious onload event handler into an image tag, which executes when the image loads. The attack does not require authentication if the editor is publicly accessible (as on the project's demo page). A proof-of-concept demonstrating the injection of an onload attribute in an `` tag has been publicly disclosed, making exploitation straightforward [3].

Impact

Successful exploitation enables an attacker to execute arbitrary JavaScript in the context of the victim's browser session when they interact with or view the malicious content. This can lead to session hijacking, data theft, or defacement within the editor's application domain [1].

Mitigation

The vendor, GetmeUK, was contacted early but has not responded or released a patch. Users of affected versions (≤1.6.16) should disable the Image Handler component or apply input validation filtering on the onload attribute as a temporary workaround. No fix is currently available, and the vulnerability remains unpatched [1][2].