Executive brief
ExpressGateway is an API gateway platform that provides REST administration interfaces. A cross-site scripting (XSS) vulnerability in the apps management endpoint allows authenticated attackers to inject malicious scripts that execute in a maintainer's browser when viewing app resources, potentially leading to account compromise or unauthorized administrative actions.
Technical details
The vulnerability is a stored/reflected XSS flaw (CWE-79) in the lib/rest/routes/apps.js REST endpoint of ExpressGateway. User-controlled input is returned by the endpoint without sanitization before being rendered by the admin UI layer. An authenticated, low-privileged actor can craft a malicious payload that executes in the browser of a maintainer viewing the affected resource. The vulnerability requires authentication and user interaction (viewing the resource), but is remotely triggerable over the network and does not affect system availability. No vendor patch is currently available.
Affected products
- ExpressGateway express-gateway 1.16.10 and earlier
Timeline
- 2025-08-18: disclosed
- 2025-08-18: advisory: GHSA-xfp8-x3j6-h67v published