---
id: CVE-2025-14695
title: >-
  A vulnerability was determined in SamuNatsu HaloBot up to
  026b01d4a896d93eaaf9d5163a287dc9f267515b
summary: >-
  A vulnerability was determined in SamuNatsu HaloBot up to
  026b01d4a896d93eaaf9d5163a287dc9f267515b. Affected is the function
  html_renderer of the file plugins/html_renderer/index.js of the component
  Inter-plugin API. Executing manipulati…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-913
published: '2025-12-15'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T19:10:00.160'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14695'
references:
  - url: 'https://github.com/rassec2/dbcve/issues/20'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?ctiid.336413'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.336413'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.705587'
    label: cna@vuldb.com
tags:
  - nvd
epss: 0.00261
epssPercentile: 0.16303
ingestedAt: '2026-10-07T19:44:15.674Z'
---

## Overview

A vulnerability was determined in SamuNatsu HaloBot up to 026b01d4a896d93eaaf9d5163a287dc9f267515b. Affected is the function html_renderer of the file plugins/html_renderer/index.js of the component Inter-plugin API. Executing manipulation of the argument action can lead to dynamically-managed code resources. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.