Medium severity5.4GHSA Advisory· Published Nov 30, 2025· Updated Apr 15, 2026

CVE-2025-66421

Description

Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
tryton-saonpm	>= 7.5.0, < 7.6.11	7.6.11
tryton-saonpm	>= 7.1.0, < 7.4.21	7.4.21
tryton-saonpm	>= 7.0.0, < 7.0.40	7.0.40
tryton-saonpm	< 6.0.69	6.0.69

Affected products

Tryton/SaoGHSA
Range: < 6.0.69
ghsa-coords
pkg:npm/tryton-sao
Range: >= 7.5.0, < 7.6.11

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-6qj9-2g9m-29x9ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-66421ghsaADVISORY
discuss.tryton.org/t/security-release-for-issue-14363/8951nvdWEB
foss.heptapod.net/tryton/tryton/-/issues/14363nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000