PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-14830 JFrog CVE debrief

A Cross-Site Scripting (XSS) vulnerability exists in JFrog Artifactory (Workers) versions from 7.94.0 through 7.117.9. This issue allows attackers to inject malicious scripts into web pages, potentially leading to security breaches. Defenders should assess exposure, prioritize remediation, and verify inventory for affected versions. The vulnerability is considered medium severity and requires verification of affected deployments, review of official advisories, and planning for vendor-supported updates or mitigations.

Vendor
JFrog
Product
Artifactory (Workers)
CVSS
MEDIUM 4.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-04
Original CVE updated
2026-09-30
Advisory published
2026-01-04
Advisory updated
2026-09-30

Who should care

Defenders responsible for JFrog Artifactory (Workers) deployments, security teams, and vulnerability management teams should assess exposure and prioritize remediation for affected versions. Operators and administrators of affected platforms should verify inventory and plan for remediation.

Why it matters

A Cross-Site Scripting (XSS) vulnerability exists in JFrog Artifactory (Workers) versions from 7.94.0 through 7.117.9, allowing attackers to inject malicious scripts into web pages. Defenders should assess exposure, prioritize remediation, and verify inventory for affected versions.

  • Defenders must verify inventory for affected JFrog Artifactory (Workers) versions.
  • Remediation is required to prevent potential XSS attacks.
  • Monitoring for potential XSS attacks is necessary.

Technical summary

The CVE record describes an XSS vulnerability in JFrog Artifactory (Workers) versions from 7.94.0 through 7.117.9. The vulnerability allows attackers to inject malicious scripts into web pages, potentially leading to security breaches. Defenders should assess exposure and prioritize remediation for affected versions. The vulnerability is considered medium severity and requires verification of affected deployments.

Defensive priority

Medium priority for defenders to verify and remediate affected Artifactory (Workers) versions.

Recommended defensive actions

  • Verify inventory for affected JFrog Artifactory (Workers) versions (7.94.0 through 7.117.9)
  • Prioritize remediation for affected versions
  • Monitor for potential XSS attacks

Evidence notes

The CVE record and NVD entry provide details on the XSS vulnerability in JFrog Artifactory (Workers). Evidence from the CVE record indicates that the vulnerability affects versions from 7.94.0 through 7.117.9. Defenders should verify inventory for affected versions and prioritize remediation. The source confidence is limited to the information provided in the CVE record and NVD entry.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-14830 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-14830

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-14830 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-14830

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.