Low severity · published Nov 13, 2025
CVE-2025-64744
OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails
3.5
CVSS
0.2%
EPSS
No
On KEV
Description
OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization with HTML in the name, the markup is rendered inside the invitation email. This indicates that user-controlled input is inserted into the email template without proper HTML escaping. As of time of publication, no patched versions are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openobserve · openobserve
<= 0.16.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-64744
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-64744
github.com
https://github.com/openobserve/openobserve/security/advisories/GHSA-3jpx-57gj-w458
More from openobserve
8.8
CVE-2024-24830
OpenObserve Privilege Escalation Vulnerability in Users API
8.7
CVE-2024-55954
OpenObserve Improper Authorization Allows Admin User to Remove Root User
8.4
CVE-2025-66223
OpenObserve's Invite Token Lifecycle Misconfiguration
7.7
CVE-2026-39361
OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url
7.5
CVE-2026-63645
OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials