Cross-Site Scripting Vulnerability in SourceCodester AI Font Matcher

CVE-2025-63708

What is CVE-2025-63708?

A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester's AI Font Matcher, allowing remote attackers to execute arbitrary JavaScript in users' browsers. This vulnerability is attributed to improper sanitization of font family names within the webfonts API handling mechanism. By intercepting fetch requests to the webfonts endpoint, an attacker can inject a malicious JavaScript payload through crafted font family names. This exploitation can lead to session cookie theft, account hijacking, and unauthorized actions performed on behalf of authenticated users. Mitigation measures should include proper input validation and sanitation to safeguard against such attacks.

References