Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/cadwyn@1.0.0
Typepypi
Namespace
Namecadwyn
Version1.0.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version5.4.3
Latest_non_vulnerable_version5.4.3
Affected_by_vulnerabilities
0
url VCID-fc98-s2k6-mkgg
vulnerability_id VCID-fc98-s2k6-mkgg
summary Cadwyn creates production-ready community-driven modern Stripe-like API versioning in FastAPI. In versions before 5.4.3, the version parameter of the "/docs" endpoint is vulnerable to a Reflected XSS (Cross-Site Scripting) attack. This XSS would notably allow an attacker to execute JavaScript code on a user's session for any application based on Cadwyn via a one-click attack. The vulnerability has been fixed in version 5.4.3.
references
0
reference_url https://github.com/zmievsa/cadwyn/commit/b424ecd57cd8dabbc8fe39b8f8ccafea629c7728
reference_id
reference_type
scores
url https://github.com/zmievsa/cadwyn/commit/b424ecd57cd8dabbc8fe39b8f8ccafea629c7728
1
reference_url https://github.com/zmievsa/cadwyn/security/advisories/GHSA-2gxp-6r36-m97r
reference_id
reference_type
scores
url https://github.com/zmievsa/cadwyn/security/advisories/GHSA-2gxp-6r36-m97r
fixed_packages
0
url pkg:pypi/cadwyn@5.4.3
purl pkg:pypi/cadwyn@5.4.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/cadwyn@5.4.3
aliases CVE-2025-53528, GHSA-2gxp-6r36-m97r, PYSEC-2025-71
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-fc98-s2k6-mkgg
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/cadwyn@1.0.0