CVE-2025-53528
Cadwyn is vulnerable to an XSS attack through its docs page
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Cadwyn is vulnerable to an XSS attack through its docs page
Cadwyn creates production-ready community-driven modern Stripe-like API versioning in FastAPI. In versions 5.4.3 and below, the version parameter of the "/docs" endpoint is vulnerable to a Reflected XSS (Cross-Site Scripting) attack. This XSS would notably allow an attacker to execute JavaScript code on a user's session for any application based on Cadwyn via a one-click attack. The vulnerability has been fixed in version 5.4.4.
Reserved 2025-07-02 | Published 2025-07-21 | Updated 2025-07-21 | Assigner GitHub_MCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
github.com/...cadwyn/security/advisories/GHSA-2gxp-6r36-m97r
github.com/...ommit/b424ecd57cd8dabbc8fe39b8f8ccafea629c7728
Support options
