CVE-2025-51489: Moonshine

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

A Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.5, allowing remote attackers to upload a malicious SVG file when creating/updating an Article and correctly execute arbitrary JavaScript when the file link is opened.

Affected products

• Moonshine Moonshine: before 3.12.5 (fixed in 3.12.5)

Published 2025-08-19. Last modified 2026-06-17.