Cross-Site Scripting Vulnerabilities in KNIME Business Hub

CVE-2025-3019

What is CVE-2025-3019?

KNIME Business Hub contains multiple vulnerabilities related to cross-site scripting (XSS) in its web pages, enabling potential attackers to exploit these weaknesses through malicious links or web pages. When a user clicks on such a link, arbitrary JavaScript could be executed within the user's browser context, leading to possible data loss or unauthorized modification of existing data. This vulnerability arises from an underlying issue in the commonly utilized nuxt-security module, which lacks viable workarounds. It is critical for users to upgrade to versions 1.13.3 or later, or 1.12.4 or later to mitigate this risk.

References