CVE-2025-29513

CVE-2025-29513 is a stored cross-site scripting (XSS) flaw, CWE-79, in NodeBB, an open-source forum platform, present in version 4.0.4 and all earlier versions. It arises in the admin control panel's API access token generator, where a remote attacker can store arbitrary code that later executes in an administrator's browser when the affected admin panel area is viewed. Successful execution lets the attacker run JavaScript in an administrator's session context, potentially enabling privileged forum actions, creation or manipulation of API access tokens, or account/session tampering; the 6.1 (medium) CVSS score with scope changed, user interaction required, and low confidentiality/integrity impacts reflects this admin-context impact. Any NodeBB deployment running version 4.0.4 or earlier is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA KEV, but EPSS assigns an elevated 41.5% probability of exploitation within 30 days (99th percentile), so patching should not be deferred.

What to do: Upgrade NodeBB to a release later than 4.0.4 that includes the vendor fix — no fixed version number is given in the available data, so check NodeBB's official advisories or repository for the patched release — and review existing admin API access tokens for unexpected or unfamiliar entries. Until patched, restrict access to the admin control panel and its API token generator, since the stored script fires when an administrator views the affected admin page.