CVE-2025-54117

The vulnerability consists of insufficient sanitization of input data entered by a logged-in user in the text editor component (dashboard text editor). An attacker with content editing permissions can embed malicious script or HTML code that will be executed in the browser of another victim when viewing the infected page. Due to the scope change (Scope: Changed), the impact of the attack may extend beyond the session of the directly attacked user. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-80 (Improper Neutralization of Script-Related HTML Tags).

An attacker can hijack a user or administrator session, steal confidential data and perform unauthorized actions on behalf of the victim, which may lead to complete takeover of the Minecraft server website.

NamelessMC should be immediately updated to version 2.2.4, where the vulnerability has been fixed. The fix commit is available at: https://github.com/NamelessMC/Nameless/commit/0e77706b2966dd9f2e30502126d6581ecc001f09

NamelessMC in versions before 2.2.3 (vulnerability removed in version 2.2.4)