CVE-2025-53834

{"id": "CVE-2025-53834", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2025-07-14T23:15:24.870", "references": [{"url": "https://github.com/caido/caido/releases/tag/v0.49.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/caido/caido/security/advisories/GHSA-h8jr-c6qq-h7m7", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Caido is a web security auditing toolkit. A reflected cross-site scripting (XSS) vulnerability was discovered in Caido\u2019s toast UI component in versions prior to 0.49.0. Toast messages may reflect unsanitized user input in certain tools such as Match&Replace and Scope. This could allow an attacker to craft input that results in arbitrary script execution. Version 0.49.0 fixes the issue."}, {"lang": "es", "value": "Caido es un kit de herramientas de auditor\u00eda de seguridad web. Se descubri\u00f3 una vulnerabilidad de cross-site scripting (XSS) reflejado en el componente de interfaz de usuario de Caido en versiones anteriores a la 0.49.0. Los mensajes de notificaci\u00f3n pueden reflejar entradas de usuario no depuradas en ciertas herramientas como Match&Replace y Scope. Esto podr\u00eda permitir que un atacante cree entradas que resulten en la ejecuci\u00f3n de scripts arbitrarios. La versi\u00f3n 0.49.0 corrige el problema."}], "lastModified": "2025-07-15T13:14:24.053", "sourceIdentifier": "security-advisories@github.com"}