CivicTheme Design System CVE-2025-12083

Exploitation requires a victim to interact with attacker-controlled content - the CVSS UI:R and the CWE-79 classification mean an authenticated or anonymous user must load a page where CivicTheme renders attacker-supplied input that is improperly neutralized during web page generation. The specific limiting factors are: the site must run CivicTheme Design System below version 1.12.0, a user must view the malicious page or click a crafted link (no silent server-side compromise), and impact is confined to the browser context (C:L/I:L, A:N). The input does not specify whether injection requires an authenticated content-editor role to plant the payload (stored) or can be delivered via request parameters (reflected), so the exact injection vector should be verified against SA-CONTRIB-2025-113.

This is a moderate-risk reflected/stored Cross-Site Scripting flaw (CWE-79) with a CVSS 3.1 base of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The signals are internally consistent and point to a genuine but not urgent issue: network-reachable and requiring no privileges (PR:N), but gated by user interaction (UI:R), with only Low confidentiality and integrity impact and a scope change (S:C) typical of XSS where the attacker's payload executes in a victim's browser context rather than the server. The EPSS score is low at 0.20% (9th percentile), indicating a low modeled probability of exploitation in the near term, and there is no CISA KEV listing and no public exploit identified at time of analysis - so no evidence of active exploitation. No SSVC decision data was provided in the input. Overall this is a standard-priority XSS to remediate on a normal patch cycle rather than an emergency; it is not a high-CVSS-but-illusory issue, but neither does it warrant drop-everything response. Note the input provides no POC or KEV data, so the real-world exploitation picture is inferred from EPSS and the absence of exploit references only.

An attacker crafts a malicious link or injects a payload into a CivicTheme-rendered component field, then lures an authenticated or anonymous site user into viewing the affected page. When the page renders the unsanitized input, the attacker's JavaScript executes in the victim's browser, enabling session/cookie theft or actions performed as the victim. No public exploit code is identified at time of analysis, but XSS of this class is trivial to weaponize.