CVE-2025-63317
📋 TL;DR
Todoist v8896 contains a stored cross-site scripting (XSS) vulnerability in its file upload API. Attackers can upload malicious SVG files containing JavaScript that executes when victims view the attachments, potentially stealing session cookies or performing actions on behalf of authenticated users. This affects all users of the vulnerable Todoist version who can upload or view attachments.
💻 Affected Systems
- Todoist
📦 What is this software?
Todoist by Doist
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, hijack user accounts, perform actions as authenticated users, or redirect to phishing sites, potentially compromising entire Todoist accounts and associated data.
Likely Case
Attackers upload malicious SVG files as task attachments, which execute JavaScript when viewed by other users, potentially stealing session tokens or performing limited unauthorized actions.
If Mitigated
With proper content security policies and input validation, the impact is limited to potential UI manipulation without significant data theft or account takeover.
🎯 Exploit Status
Exploitation requires the ability to upload files to Todoist (typically authenticated users). The GitHub reference shows proof-of-concept SVG files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: unknown
Vendor Advisory: none
Restart Required: No
Instructions:
1. Monitor Todoist for security updates. 2. Upgrade to a patched version when available. 3. Review release notes for XSS fixes in upload functionality.
🔧 Temporary Workarounds
Disable SVG uploads
allBlock SVG file uploads at the application or network level
Implement WAF rules
allAdd web application firewall rules to block malicious SVG content
🧯 If You Can't Patch
- Disable file upload functionality entirely in Todoist
- Implement strict content security policies (CSP) to block inline JavaScript execution
🔍 How to Verify
Check if Vulnerable:
Upload an SVG file containing <script>alert('XSS')</script> to Todoist and check if JavaScript executes when viewedCheck Version:
Check Todoist version in application settings or about pageVerify Fix Applied:
Test SVG uploads with embedded JavaScript to confirm they no longer execute📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads
- Large number of file uploads from single user
- Uploads with script tags in content
Network Indicators:
- POST requests to /api/v1/uploads with SVG content
- File uploads containing JavaScript patterns
SIEM Query:
source="todoist" AND (url="/api/v1/uploads" OR file_type="svg") AND content CONTAINS "<script>"