HTML Injection Vulnerability in OpenObserve Cloud-Native Observability Platform

CVE-2025-64744

What is CVE-2025-64744?

OpenObserve, a cloud-native observability platform, is susceptible to an HTML injection vulnerability in versions up to and including 0.16.1. When users create or rename an organization with HTML content in the name, this content is improperly processed and rendered within invitation emails. This means that user-controlled input is inserted into the email template without appropriate HTML escaping, potentially allowing attackers to execute malicious scripts or exploit the platform's functionality. At present, no patches have been released to address this vulnerability.

References