Security fix for CVE issue with dependency and improvements to Dark Theme Support.
On we released version 3.1.2 of Userscripts for Confluence!
Summary
This is a security fix based on a CVE report.
It also provides some improvements for Confluence Dark Theme, especially in the Swagger UI.
New and Noteworthy
This release provides the following new and noteworthy features.
CVE-2025-48924
The Userscripts for Confluence app uses the platform dependency to commons-lang in a version that has been reported vulnerable to CVE-2025-48924.
For detailed information, please refer to https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1.
The vulnerability is reported to be fixed in 3.18.0. This version updates this dependency.
Installation Instructions
Simply install the app via the Atlassian Marketplace or the downloaded OBR artifact.
If you use a previous version of Confluence, please select Userscripts for Confluence 2.4.3.
Upgrade Instructions
This version supports Confluence version 9.2.x. and later.
For previous versions of Confluence there are separate versions of the projectdoc Toolbox:
- If you use a version of Confluence < 9.x , please select Userscripts for Confluence 2.4.3
- For Confluence 9.0.x and 9.1.x we recommend to upgrade to Confluence 9.2.x (LTS) or alternatively use version 3.0.x of Userscripts for Confluence
List of Changes
Key | Summary | T | P | Status | Resolution | Description |
---|---|---|---|---|---|---|
USR4C-49 | Update CSS and Images for Dark Theme |
|
![]() |
Done | Fixed |
Make the highlighting in the scripts’s list and the images compatible with Confluence Dark Theme. |
USR4C-47 | CVE-2025-48924 affects pkg:maven/org.apache.commons/commons-lang3@3.17.0 |
|
|
Done | Fixed |
The Userscripts for Confluence app uses the platform dependency to commons-lang in a version that has been reported vulnerable to CVE-2025-48924. For detailed information, please refer to https://lists.apache.org/thread/bgv0lpswokgol11tloxnjfzdl7yrc1g1. The vulnerability is reported to be fixed in 3.18.0 and above. |
USR4C-48 | start-index defaults to zero |
|
![]() |
Done | Fixed |
The start-index parameter of the /userscripts REST service is marked as required. The parameter must be marked as optional since it defaults to zero. |