一、 漏洞 CVE-2025-65368 基础信息

                                        # N/A

## 概述
SparkyFitness v0.15.8.2 存在跨站脚本攻击（XSS）漏洞，攻击者可通过恶意用户输入或LLM输出触发。

## 影响版本
v0.15.8.2

## 细节
该漏洞源于对用户输入和LLM输出的内容未进行充分的输入过滤与输出编码，导致恶意脚本可被注入并执行于受害者浏览器中。

## 影响
攻击者可利用此漏洞在用户浏览器中执行任意脚本，窃取会话信息、劫持用户账户或进行钓鱼攻击。
                                        

二、漏洞 CVE-2025-65368 的公开POC

三、漏洞 CVE-2025-65368 的情报信息

• 标题： GitHub - CodeWithCJ/SparkyFitness: SparkyFitness: Built for Families. Powered by AI. Track food, fitness, water, and health — together. -- 🔗来源链接

  标签：

  神龙速读：

                                          # SparkyFitness Vulnerability Analysis
  
  From the screenshot of the GitHub repository `CodeWithCJ/SparkyFitness`, the following key information about potential security vulnerabilities can be inferred:
  
  ## Repository Structure and Technology Stack
  
  - **Languages Used**: TypeScript (62.6%), JavaScript (30.6%), PLpgSQL (5.1%), Python (1.3%), Shell (0.3%), and CSS (0.1%).
  - **Frontend and Backend Separation**: The repository is organized into separate directories for frontend and backend components (`SparkyFitnessFrontend`, `SparkyFitnessGarmin`, `SparkyFitnessMobile`, `SparkyFitnessServer`).
  
  ## Security Considerations
  
  - **OpenSource and Public Access**: The repository is public, which means anyone can access the code, potentially identifying vulnerabilities.
  - **Self-Hosted**: The project is intended for self-hosting, which puts the onus on users to ensure security practices and keep the software up to date.
  - **Dependencies and Libraries**: With a mix of languages and potentially various libraries and dependencies, there is an increased risk of vulnerabilities in third-party components.
  - **AI Integration**: The AI Nutrition Coach (SparkyAI) adds an additional layer of complexity and potential vulnerabilities related to AI interactions and data handling.
  - **Data Privacy**: Given the application's focus on health data (nutrition, exercise, water intake, etc.), data privacy and protection should be a priority to prevent unauthorized access or breaches.
  
  ## Actions for Securing the Application
  
  1. **Regular Security Audits**: Perform regular security audits and code reviews to identify and address vulnerabilities.
  2. **Dependency Management**: Keep dependencies up to date to mitigate risks from outdated libraries.
  3. **Input Validation**: Implement robust input validation to prevent injection attacks and other common vulnerabilities.
  4. **Data Encryption**: Ensure sensitive data is encrypted both in transit and at rest to protect user information.
  5. **Access Controls**: Implement strong access controls and secure authentication to prevent unauthorized access.
  6. **AI Security**: Ensure the AI components are secure and handle data appropriately to prevent misuse.
  
  ## Conclusion
  
  While `SparkyFitness` offers a valuable self-hosted fitness tracking solution, users and developers should be vigilant about implementing security best practices to protect against potential vulnerabilities.
                                          

  

• 标题： Stored XSS in versions <= v0.15.8.2 · Advisory · CodeWithCJ/SparkyFitness · GitHub -- 🔗来源链接

  标签：

  神龙速读：

                                          ### 关键信息
  
  - **漏洞类型:** 存储型跨站脚本攻击 (XSS)
  - **受影响版本:** <= v0.15.8.2
  - **修复版本:** >v0.15.8.2
  - **漏洞ID:** GHSA-j7x6-6678-2xqp
  - **严重程度:** 中等 (5.4/10)
  - **CVSS v3基础指标:** 
    - 攻击向量: 网络
    - 攻击复杂性: 低
    - 需要权限: 低
    - 用户交互: 必要
    - 影响范围: 变更
    - 机密性影响: 低
    - 完整性影响: 低
    - 可用性影响: 无
  - **弱项:** CWE-80
  - **报告人:** oxjams
  - **漏洞描述:** 
    - 该漏洞存在于SparkyFitness v0.15.8.2中，允许远程攻击者在经过身份验证的用户上下文中执行任意JavaScript。问题是由于使用dangerouslySetInnerHTML渲染未经过足够净化的用户控制输入和LLM生成的输出所导致的。
    - v0.16.3通过使用DOMPurify对渲染内容进行净化来缓解此问题。虽然危险的API仍在使用，但在渲染前用户控制内容现在已进行了净化。
  - **PoC:**
    - 先决条件: 运行中的SparkyFitness v0.15.8.2实例，经过身份验证的用户帐户以及对AI聊天机器人的访问。
    - 重现步骤: 向AI聊天机器人发送特定消息，该消息将被存储为聊天历史的一部分。当聊天被渲染时，浏览器会执行注入的JavaScript。
  - **潜在影响:** 
    - 任意JavaScript执行
    - 伪造的AI消息看起来像是合法的LLM输出
    - 使用受害者的凭证进行未经授权的API调用
                                          

  
• https://nvd.nist.gov/vuln/detail/CVE-2025-65368

四、漏洞 CVE-2025-65368 的评论