Loading vulnerability…
HTML/JavaScript Injection via Incorrect Content-Type in BLU-IC2 and BLU-IC4 APIs
CVE-2025-11925 affects BLU-IC2 and BLU-IC4 through version 1.19.5. One of the affected APIs returns an incorrect HTTP Content-Type header of text/html instead of the expected application/json. According to the provided description, this behavior may allow HTML or JavaScript to be injected into the API reply. In practice, mislabeling a JSON response as HTML can cause clients or browsers to interpret response content in an unsafe context, increasing the risk that injected markup or script is rendered or executed rather than treated as inert data. The issue is described as remotely exploitable and is mapped in the source material to CWE-754.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may allow an attacker to inject HTML or JavaScript into API responses. If those responses are consumed in a browser or another client that honors the incorrect text/html content type, the injected content could be rendered or executed in the context of the consuming application or user session. This can lead to client-side code execution, content spoofing, session compromise, unauthorized actions in the victim's browser context, and potential downstream impacts to confidentiality and integrity. The provided source also characterizes the vulnerability as remotely exploitable.
If you can’t patch tonight, do this now.
Until a vendor fix is applied, reduce exposure of the affected API endpoints to untrusted networks and clients where possible. Ensure reverse proxies, API gateways, or web servers override incorrect response headers and enforce application/json for JSON endpoints. Avoid rendering raw API responses in browser contexts, and apply output encoding and strict client-side handling so response data is treated as data rather than active HTML. Additional browser-side hardening such as a restrictive Content Security Policy may reduce script-execution risk, but it does not replace correcting the server-side content type.
Patch, then assume compromise.
Update affected BLU-IC2 and BLU-IC4 deployments to a fixed version later than 1.19.5 if available from the vendor. The specific remediation described in the provided material is to correct the affected API so that it consistently returns the proper Content-Type: application/json header rather than text/html. Review all API endpoints for similar response-header mismatches and ensure response bodies are emitted with content types matching their actual format.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.