Executive brief
Dependency-Track is a supply chain management platform used to track software components and vulnerabilities. A flaw in the login page branding feature allows administrators to inject malicious code that executes in the browsers of all users accessing the login page, potentially stealing credentials or redirecting users to phishing sites.
Technical details
This is a persistent cross-site scripting (XSS) vulnerability in the welcome message rendering functionality, introduced in version 4.12.0. The vulnerability exists because HTML content configured by users with SYSTEM_CONFIGURATION privilege (administrators) is not properly sanitized before being rendered on the login page. An authenticated administrator can inject arbitrary JavaScript that executes in the context of unauthenticated users visiting the login page. The attack requires administrator privileges and user interaction (visiting the login page), but has changed scope (affects resources beyond the vulnerable component). The issue was fixed in version 4.13.6 by properly sanitizing HTML input.
Affected products
- Dependency-Track Frontend 4.12.0 to 4.13.5
Timeline
- 2025-11-17: disclosed: GHSA-7xvh-c266-cfr5 published
- 2025-11-17: patched: Fixed in version 4.13.6