JPACookieShop CVE-2025-8222

No specific patched version is identifiable due to the continuous delivery model; coordinate with jerryshensjf project maintainers via GitHub to confirm if fixes have been merged to the main branch post-disclosure (check https://github.com/Bemcliu/cve-reports and the official JPACookieShop repository for remediation commits). Immediate compensating controls: (1) Implement strict HTML entity encoding on all product data (name, description, attributes) in GoodsController response templates using a templating engine with auto-escaping enabled (e.g., Thymeleaf with th:text instead of th:utext); (2) Deploy a Content Security Policy (CSP) header restricting inline scripts (Content-Security-Policy: default-src 'self'; script-src 'self') to prevent payload execution; (3) Restrict authenticated user access to GoodsController endpoints via role-based access control if editing product data is admin-only; (4) Conduct input validation on product fields server-side to reject or sanitize special characters before persistence. Trade-off: CSP may break legitimate product display features if inline event handlers are used; coordinate template refactoring accordingly.