CVE-2025-12518 in Befree SDK
Summary
by MITRE • 03/18/2026
beefree.io SDK is vulnerable to Stored XSS in Social Media icon URL parameter in email builder functionality. Malicious attacker can inject arbitrary HTML and JS into template, which will be rendered/executed when visiting preview page. However due to beefree's Content Security Policy not all payloads will execute successfully.
This issue has been fixed in version 3.47.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/22/2026
The vulnerability identified as CVE-2025-12518 affects the beefree.io software development kit and represents a stored cross-site scripting flaw within the email builder functionality. This security weakness specifically targets the Social Media icon URL parameter, creating a persistent threat vector that allows attackers to inject malicious code into email templates. The vulnerability exists in the way the platform processes and stores user-provided URL parameters for social media icons, which are then rendered on preview pages without adequate input sanitization or output encoding mechanisms.
The technical implementation of this flaw demonstrates a classic stored XSS vulnerability pattern where malicious input is first accepted and stored by the application's backend systems, then subsequently retrieved and executed in the context of other users' browsers. When users navigate to preview pages containing compromised social media icon URLs, the embedded JavaScript code executes in their browser context, potentially leading to session hijacking, credential theft, or redirection to malicious sites. The vulnerability's classification aligns with CWE-079 - Cross-site Scripting, which specifically addresses improper neutralization of input during web page generation. The attack surface is particularly concerning given that email builders are frequently used by marketing teams and require trust in the platform's security, making them ideal targets for attackers seeking to compromise end users.
The operational impact of this vulnerability extends beyond simple code execution as it represents a significant threat to user privacy and data integrity within the beefree ecosystem. Attackers could leverage this flaw to steal authentication tokens, monitor user activities, or redirect users to phishing sites that appear legitimate due to the trusted platform context. The fact that the vulnerability is stored rather than reflected means that the malicious payload persists even after the initial injection, allowing attackers to maintain access to affected users over extended periods. This characteristic makes the vulnerability particularly dangerous in enterprise environments where email templates are shared among teams and may be previewed by multiple users. The security implications align with ATT&CK technique T1531 - Account Access Removal and T1566 - Phishing, as attackers could use this vector to establish persistent access to user accounts or trick users into providing sensitive information.
The Content Security Policy (CSP) implemented by beefree provides partial protection against this vulnerability but does not offer complete defense, as demonstrated by the issue description noting that "not all payloads will execute successfully." This partial mitigation suggests that while the platform implements some security controls, they are insufficient to prevent all forms of malicious script execution. The CSP may block certain script sources or restrict execution contexts, but sophisticated attackers could potentially craft payloads that bypass these protections or exploit other vectors within the application. The vulnerability's remediation in version 3.47.0 indicates that the developers addressed the root cause by implementing proper input validation and output encoding mechanisms, which are fundamental requirements for preventing XSS attacks according to OWASP Top Ten and NIST cybersecurity guidelines. The fix likely involved sanitizing URL parameters before storage, implementing strict input validation for URL formats, and ensuring that all user-provided content is properly encoded before being rendered in the browser context. Organizations using beefree.io should immediately update to version 3.47.0 or later to ensure complete protection against this vulnerability and should consider conducting security assessments of any previously created email templates that may contain malicious payloads.