Taguette CVE-2025-62528

Exploitation requires the attacker to be an existing member of a Taguette project (collaborative/multi-user deployment) and the ability to edit tag or document name/description fields; the payload stored there executes only when another project member loads the project (user interaction required). Limiting factors: this is not remotely exploitable by anonymous outsiders - authenticated project membership is needed (PR:L), a victim must open the affected project (UI:R), and it is only relevant to shared multi-user projects rather than single-user installations. All versions prior to 1.5.0 are affected; upgrading to 1.5.0 remediates it.

This is a stored cross-site scripting flaw (CWE-79) in Taguette, scored CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The vector is network-reachable with low complexity, but it requires PR:L - an authenticated project member - and UI:R, meaning a victim must load the affected project for the injected script to execute; the scope change (S:C) reflects that the payload runs in the context of other users' browsers rather than only the attacker's. All exploitation signals point low: EPSS is 0.18% (7th percentile), the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced in the provided intelligence. There is no conflict between signals here - low EPSS, absence from KEV, and no POC consistently indicate this is a low-priority, non-urgent issue rather than a high-risk one. The impact is bounded (C:L/I:L, no availability impact) and exploitation presupposes a trusted-but-malicious or compromised project collaborator, limiting it to multi-user collaborative deployments. This is a legitimate defense-in-depth fix but not a drop-everything priority.

A user who is already a member of a shared Taguette project enters malicious JavaScript into a tag or document name/description field. When another project member subsequently opens (loads) that project, the stored script executes in their browser session, enabling actions such as session/cookie theft or performing actions as the victim within the application. No public exploit code has been identified at time of analysis.