DOM-Based Cross-Site Scripting in Onlook Web Application by Onlook
CVE-2025-63785

6.1MEDIUM

Key Information:

Vendor

Onlook

Status
Onlook Web Application
Vendor
CVE Published:
7 November 2025

What is CVE-2025-63785?

A vulnerability in the Onlook web application's text editor feature allows for a DOM-based Cross-Site Scripting (XSS) attack. The issue arises from the lack of proper sanitization of user-supplied input which gets directly injected into the DOM via innerHTML when users edit text elements. Attackers can exploit this weakness to insert and execute malicious HTML and script code in the context of the user's session within the preview iframe, potentially compromising user data and leading to unauthorized actions.

References

https://tossbank.notion.site/DOM-XSS-in-onlook-27e557175d...
https://blog.soohyun.tech/CVE-2025-63785-DOM-XSS-in-Onloo...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.