CVE-2025-57292

Todoist version v8484 is vulnerable to a stored cross-site scripting (XSS) vulnerability within the avatar upload functionality . The root cause is the application's failure to properly validate MIME types and sanitize image metadata . This security flaw could allow for the execution of malicious...