High severity · published Aug 10, 2025
CVE-2025-8797
LitmusChaos Litmus LocalStorage permission
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was found in LitmusChaos Litmus up to 3.19.0 and classified as critical. This issue affects some unknown processing of the component LocalStorage Handler. The manipulation leads to permission issues. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Litmus · LitmusChaos
3.0; 3.1; 3.2; 3.3; 3.4; 3.5; +14 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8797
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8797
Exploit
https://github.com/MaiqueSilva/VulnDB/blob/main/readme07.md
Permissions Required
https://vuldb.com/?ctiid.319325
Third Party Advisory
https://vuldb.com/?id.319325
Third Party Advisory
https://vuldb.com/?submit.625991
More from Litmus
9.9
CVE-2025-8795
LitmusChaos Litmus login access control
7.8
CVE-2025-8794
LitmusChaos Litmus LocalStorage authorization
7.1
CVE-2025-14261
Lack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privileges
6.3
CVE-2025-8791
LitmusChaos Litmus list_projects improper authorization
5.4
CVE-2025-8796
LitmusChaos Litmus Delete Request delete_project authorization