CVE-2025-9096

ExpressGateway express-gateway REST Endpoint apps.js cross site scripting

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.13.5Low EPSS percentile23rd0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixNone yetNo fix or workaround published

Published 2025-08-17Updated 2026-04-29Sources: CVE.org, NVD, GitHub

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

ExpressGateway express-gatewayAffected: 1.16.0Upgrade to: not statedAffected: 1.16.1Upgrade to: not statedAffected: 1.16.2Upgrade to: not statedAffected: 1.16.3Upgrade to: not stated + 7 more branchesStated by: CVE record
Npm Express-gatewayAffected: ≤ 1.16.10Upgrade to: after 1.16.10Stated by: GitHub advisory

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run ExpressGateway and whether its version is 1.16.10 or earlier.
Restrict access to the ExpressGateway REST Endpoint to trusted administrators and networks while it remains unpatched.
No fixed version is publicly available; ask the vendor or maintainer for a supported remediation version before upgrading.
Review administrator accounts and recent changes to application settings for unexpected content or activity.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability has been found in ExpressGateway express-gateway up to 1.16.10. Affected is an unknown function in the library lib/rest/routes/apps.js of the component REST Endpoint. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

In plain language

Written by AI from the record

ExpressGateway versions up to 1.16.10 can let a logged-in attacker place harmful content in a web page, so businesses using it should reduce exposure and seek vendor guidance now.

Stored or reflected cross-site scripting in ExpressGateway’s REST Endpoint apps.js route allows a low-privileged attacker to inject client-side script that executes when another user views the affected page.

If you're affected

Unauthorized page changes
Session theft risk
Misleading customer pages
Admin account misuse

What is it

This flaw can allow someone with access to place harmful instructions into a web page that runs when another person opens it. It is like leaving a convincing but altered note at a staff-only counter: the next employee may act on it as though it were legitimate.

Who is affected

This matters to you if you run ExpressGateway, especially if people outside your trusted administrator group can use its management interface. An attacker needs a login and must get another user to open the affected content.

How urgent is it

A public demonstration of the attack exists, which lowers the effort needed for someone to try it. There is no confirmed real-world exploitation and the predicted likelihood is low, so this is an amber issue: contain access and obtain remediation promptly rather than treating it as an emergency outage.

What to do — in detail

Confirm the deployed ExpressGateway version and identify whether the REST Endpoint, including the apps route, is reachable by untrusted users or shared with lower-privileged accounts. Versions through 1.16.10 are affected according to the available description; no vendor fixed version or supported upgrade path is currently published.

Until a fix is available, place the REST management interface behind a VPN, private network, or IP allowlist; limit access to only required administrators; and remove unnecessary low-privileged accounts. Because the attack relies on a user viewing injected content, review recent application-management changes and investigate unexpected scripts, page content, administrator sessions, or configuration edits.

There is no CISA KEV due date because this CVE is not listed in KEV. Track the ExpressGateway maintainer’s advisory or release information for a fixed version, then test and deploy that supported release as soon as it is published.

Technical context

CVSS 3.1: 3.5 (Low), vector AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. The reported weakness is CWE-79 cross-site scripting, with CWE-94 also listed. The vulnerable area is lib/rest/routes/apps.js in the REST Endpoint, affecting ExpressGateway through 1.16.10. A public GitHub proof of concept is known, but the findings do not confirm exploitation in the wild. It is not in CISA KEV. EPSS is 0.3% (23rd percentile) with a flat trend; this is predictive rather than evidence of exploitation. Press attention is rising.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS23rd

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 23rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 396 days, from the signal feeds we watch.

2026-09-17OpenVAS check added
2026-04-29Record updated
2026-03-07Public exploit / PoCsource: github-poc
2025-08-17Publishedweakness classified, att&ck mapped

Affected products

ExpressGatewaycommercialaka express-gateway
- express-gatewayOn-premCloud & SaaS / api-gateway
npmpackage-ecosystem
- express-gatewayOSS Libraries

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Scored 3.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction RequiredA user must click a link, open a file, or perform some action