CVE-2025-8535 is a cross site scripting flaw in the custom URL handler of NanoVault up to version 1.2.1. The record scores it CVSS 3.5, Low, but the researcher's write-up describes one click remote code execution. The vendor did not respond, so no fix is confirmed.
What's affected
- Product: cronoh NanoVault, versions up to and including 1.2.1.
- Component: the
executeJavaScriptcall inmain.js, in the component that handles the custom URL scheme named in the record. - Weaknesses: CWE-79 (cross-site scripting) and CWE-94 (code injection).
- Score: CVSS 3.1 base 3.5, Low, vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. It needs a low privileged account and user interaction, with limited impact on integrity. - Fixed version: none. The record says the vendor was contacted early and did not respond.
This is a case where the sources disagree on severity. The record classifies the weakness as cross site scripting and gives it a Low score. The researcher's write-up, a public gist I fetched, is titled as a one click remote code execution through custom URL handling in version 1.2.1. Both are reported here. The gap matters because a script that runs inside a desktop application shell can have far more reach than script in a web page. Treat the Low score as a floor, not a ceiling, until someone settles it.
The record says the exploit has been disclosed to the public. It does not mark the CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
NanoVault is a desktop application, so the question is whether it is installed on any machine you manage and which version it is. Open the application's About screen, or check the installed version in your software inventory.
On a managed fleet, search for the application by name in your endpoint inventory. If you cannot list installed software, ask the people who handle the wallet or funds software on your team.
You are exposed if version 1.2.1 or earlier is installed and a user can be persuaded to open a link that the application registered to handle. The risky action is a click, so the people most at risk are those who open links from chat, email or web pages while the app is installed.
What to do now
- Find every install of NanoVault and record the version.
- Stop opening links that launch the application. If you can, remove the custom URL association from the operating system.
- If it holds funds, consider moving them to software that is actively maintained, since the vendor has not responded and no fix is confirmed.
- Tell the users involved not to click unsolicited links that open desktop applications.
- Check the project page and the CVE record for a patched release before you decide to keep it.
Why it matters
Custom URL handlers let a web page or message start a desktop program with a piece of data. If the program places that data into a script without cleaning it, text from a stranger becomes code. Applications built on a web shell make this easy to get wrong, because the line between page content and local power is thin.
An abandoned project makes it worse. With no vendor response, there is nobody to ship the fix, and the decision to retire the software falls to you.
You can run the free in-browser dependency scan at gold.safeguard.sh/scan on your manifests to see which known-vulnerable packages you carry. It reads dependencies, so it will not see a flaw that lives only in an application's own source.
Quick check
Why is a Low score paired with a remote code execution write-up?
The record classifies the weakness as cross site scripting and scores it that way. The researcher reports a stronger outcome. The two have not been reconciled, so plan for the worse case.
Is there a patched NanoVault?
None is confirmed. The record says the vendor did not respond.
Sources
- Safeguard Gold entry: CVE-2025-8535 (NVD record data: description, CVSS, CWEs, published 2025-08-05)
- Researcher write-up listed in the record: https://gist.github.com/jackfromeast/1e2e206813887a470e00b8474c616567
Last reviewed: 18 October 2026.
