Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

tryton-sao

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.4npmAmendedPublished

    Tryton sao allows XSS via an HTML attachment

    CVE-2025-66420 · GHSA-xhgv-99mj-8m2x

    Affected
    • npm tryton-sao >= 7.5.0, < 7.6.9; >= 7.1.0, < 7.4.19; >= 7.0.0, < 7.0.38; < 6.0.67
    Fixed in
    7.0.386.0.677.4.197.6.9· Vendor fix available
    Issue
    Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.

    Recommended action: Upgrade to 7.6.9, 7.4.19, 7.0.38 or 6.0.67 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. Medium, CVSS 5.4npmAmendedPublished

    Tryton sao allows XSS because it does not escape completion values

    CVE-2025-66421 · GHSA-6qj9-2g9m-29x9

    Affected
    • npm tryton-sao >= 7.5.0, < 7.6.11; >= 7.1.0, < 7.4.21; >= 7.0.0, < 7.0.40; < 6.0.69
    Fixed in
    7.0.407.6.116.0.697.4.21· Vendor fix available
    Issue
    Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.

    Recommended action: Upgrade to 7.6.11, 7.4.21, 7.0.40 or 6.0.69 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →