5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66420

CVE-2025-66420: Tryton sao allows XSS via an HTML attachment

Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66420

CVE-2025-66420:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
tryton-sao	npm	>= 7.5.0, < 7.6.9	7.6.9
tryton-sao	npm	>= 7.1.0, < 7.4.19	7.4.19
tryton-sao	npm	>= 7.0.0, < 7.0.38	7.0.38
tryton-sao	npm	< 6.0.67	6.0.67

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis began by reviewing the vulnerability description and reference URLs. The key information was that the vulnerability is an XSS in HTML attachment previews in tryton-sao. The provided Heptapod link was not directly accessible by the tools. However, by cross-referencing the patched versions and the security announcement, I was able to locate the fixing commit in the tryton/sao repository on Heptapod with the message 'Sandbox attachment preview'. Although the tools could not directly process this non-GitHub repository, manual inspection of this commit revealed the exact code change that mitigated the vulnerability. The change was in the preview function of the Attachment view in src/view/form/attachment.js. The vulnerable code, which used window.open() and document.write(), was replaced with a sandboxed iframe. This directly points to Attachment.preview as the vulnerable function.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.