CVE-2025-65368 Details

A stored cross-site scripting vulnerability has been identified in SparkyFitness version 0.15.8.2. This issue allows remote attackers to execute arbitrary JavaScript in the context of authenticated users. The vulnerability arises from the application rendering unsanitized user input and output generated by a language model (LLM) into the DOM using React's dangerouslySetInnerHTML. This lack of proper sanitization enables the injection of malicious payloads that are persisted and can be executed later, potentially leading to session hijacking, unauthorized actions on behalf of the victim, and the creation of fake messages in the AI chat interface.

Users can update to SparkyFitness version 0.16.3 or later, where this vulnerability has been addressed by sanitizing rendered content before it is displayed.