CVE-2025-1987

The vulnerability affects 'website_password' and 'bookmark' type entries in the Psono vault. The application does not properly sanitize the URL field, allowing 'javascript:' format values to be embedded instead of valid URLs. The attacker must trick the user into creating or importing a crafted entry — for example by sharing a malicious import file or convincing them to manually add an entry. When the victim interacts with such an entry (e.g., clicks on it or opens it), the embedded JavaScript code is executed in the context of the Psono application in the user's browser.

An attacker can execute arbitrary JavaScript code in the context of the victim's password vault, which may lead to theft of stored passwords and other sensitive data. If the attack is successful, the entire user credential management environment is compromised.

Security patches from the vendor should be applied according to the references (Bitdefender security advisory: https://bitdefender.com/support/support/security-advisories/stored-xss-in-psono-client-via-malicious-vault-entry-urls). Users should avoid importing password vault entries from untrusted sources.

Bitdefender SecurePass and Esaqa Psono Client — versions specified in vendor references