CVE-2025-9095

ExpressGateway express-gateway REST Endpoint users.js cross site scripting

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.13.5Low EPSS percentile18th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixNone yetNo fix or workaround published

Published 2025-08-17Updated 2026-04-29Sources: CVE.org, NVD, GitHub

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

ExpressGateway express-gatewayAffected: 1.16.0Upgrade to: not statedAffected: 1.16.1Upgrade to: not statedAffected: 1.16.2Upgrade to: not statedAffected: 1.16.3Upgrade to: not stated + 7 more branchesStated by: CVE record
Npm Express-gatewayAffected: ≤ 1.16.10Upgrade to: after 1.16.10Stated by: GitHub advisory

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Confirm whether you run express-gateway and whether its REST user-management endpoint is enabled or accessible to users.
Ask your IT provider to restrict access to the user-management endpoint to trusted administrators while no fixed version is available.
Watch for an official express-gateway security update; no fixed version has been published in the available findings.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/users.js

In plain language

Written by AI from the record

A low-severity flaw in express-gateway may let a logged-in attacker place harmful web content through its user-management endpoint; typical small businesses should have it reviewed, but no fix is currently available.

Authenticated, user-interaction-required cross-site scripting in ExpressGateway’s REST `users.js` endpoint, with CWE-79 and CWE-94 classifications; no vendor patch information is available.

If you're affected

Altered user-management pages
Misleading staff actions
Limited account-interface tampering

What is it

This is a flaw in a user-management part of express-gateway that may allow harmful web content to be stored or shown in an administrator’s browser. It is like someone slipping a convincing but unsafe instruction into a shared office form: when another staff member opens it, the content may try to act within that person’s session.

Who is affected

This matters to you if you run express-gateway, particularly if people can use its REST user-management endpoint. The risk requires an attacker to already have a login and another person to view the harmful content.

How urgent is it

A public proof-of-concept is available, so treat this as a real issue to contain rather than ignore. The reported severity is low and there is no evidence in the findings that it is being used in real attacks, making this an amber review-and-restrict priority.

What to do — in detail

Confirm deployment by inventorying express-gateway instances and reviewing whether the REST user-management route is enabled, which identities can reach it, and whether it is reachable from untrusted networks. Review the lib/rest/routes/users.js implementation and any inputs it accepts for unsafe rendering or evaluation paths.

No fixed version or supported upgrade path is available in the findings, so do not claim a target release. Until a vendor advisory provides one, limit the endpoint to dedicated administrator accounts and trusted network locations, remove unnecessary access, and avoid entering or displaying untrusted user-supplied content in its administrative interface.

Track the upstream express-gateway project for a security advisory or release addressing CVE-2025-9095. There is no CISA KEV due date because this CVE is not listed in CISA KEV. Review application and access logs for unexpected changes or unusual requests involving the user-management endpoint.

Technical context

CVSS v3.1 is 3.5 (Low): AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. The reported issue is cross-site scripting in lib/rest/routes/users.js for ExpressGateway, classified as CWE-79 and CWE-94. A public GitHub proof-of-concept is known, but the findings do not confirm exploitation in the wild and CISA KEV does not list the CVE. EPSS is 0.3% (18th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS18th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 18th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 396 days, from the signal feeds we watch.

2026-09-17OpenVAS check added
2026-04-29Record updated
2026-03-07Public exploit / PoCsource: github-poc
2025-08-17Publishedweakness classified, att&ck mapped

Affected products

npmpackage-ecosystem
- express-gatewayOSS Libraries
ExpressGatewaycommercialaka express-gateway
- express-gatewayOn-premCloud & SaaS / api-gateway

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Scored 3.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction RequiredA user must click a link, open a file, or perform some action