CVE-2025-27608

The vulnerability is a Self-XSS (Cross-Site Scripting) issue in Arduino IDE versions prior to 2.3.5. It arises in the Additional Board Manager URLs field within Preferences → Settings. User-supplied values are rendered directly in a notification tooltip without proper output encoding, allowing JavaScript execution in the ElectronJS context [1].

Exploitation requires user interaction, typically via social engineering to trick a user into pasting malicious input. Since it is a Self-XSS, the attacker cannot directly inject code without the victim's involvement. However, the underlying ElectronJS engine interprets the payload, making it possible to execute arbitrary JavaScript in the context of the IDE [1].

The impact includes potential compromise of sensitive information, access tokens, or triggering unintended actions within the application. The severity is low due to the need for user interaction, but it can still be leveraged in targeted attacks [1].

Mitigation is straightforward: update to Arduino IDE version 2.3.5 or later. The fix, visible in commit [2], adds DOMPurify sanitization to the notification component, encoding the message before rendering via dangerouslySetInnerHTML [2].