Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-fc98-s2k6-mkgg
Vulnerability ID VCID-fc98-s2k6-mkgg
Aliases CVE-2025-53528
GHSA-2gxp-6r36-m97r
PYSEC-2025-71
Summary Cadwyn creates production-ready community-driven modern Stripe-like API versioning in FastAPI. In versions before 5.4.3, the version parameter of the "/docs" endpoint is vulnerable to a Reflected XSS (Cross-Site Scripting) attack. This XSS would notably allow an attacker to execute JavaScript code on a user's session for any application based on Cadwyn via a one-click attack. The vulnerability has been fixed in version 5.4.3.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.6 https://github.com/pypa/advisory-database/tree/main/vulns/cadwyn/PYSEC-2025-71.yaml
generic_textual HIGH https://github.com/pypa/advisory-database/tree/main/vulns/cadwyn/PYSEC-2025-71.yaml
cvssv3.1 7.6 https://github.com/zmievsa/cadwyn
generic_textual HIGH https://github.com/zmievsa/cadwyn
cvssv3.1 7.6 https://github.com/zmievsa/cadwyn/blob/5.4.3/CHANGELOG.md#543
generic_textual HIGH https://github.com/zmievsa/cadwyn/blob/5.4.3/CHANGELOG.md#543
cvssv3.1 7.6 https://github.com/zmievsa/cadwyn/commit/b424ecd57cd8dabbc8fe39b8f8ccafea629c7728
generic_textual HIGH https://github.com/zmievsa/cadwyn/commit/b424ecd57cd8dabbc8fe39b8f8ccafea629c7728
cvssv3.1 7.6 https://github.com/zmievsa/cadwyn/security/advisories/GHSA-2gxp-6r36-m97r
generic_textual HIGH https://github.com/zmievsa/cadwyn/security/advisories/GHSA-2gxp-6r36-m97r
cvssv3.1 7.6 https://nvd.nist.gov/vuln/detail/CVE-2025-53528
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2025-53528
Reference id Reference type URL
https://github.com/pypa/advisory-database/tree/main/vulns/cadwyn/PYSEC-2025-71.yaml
https://github.com/zmievsa/cadwyn
https://github.com/zmievsa/cadwyn/blob/5.4.3/CHANGELOG.md#543
https://github.com/zmievsa/cadwyn/commit/b424ecd57cd8dabbc8fe39b8f8ccafea629c7728
https://github.com/zmievsa/cadwyn/security/advisories/GHSA-2gxp-6r36-m97r
CVE-2025-53528 https://nvd.nist.gov/vuln/detail/CVE-2025-53528
GHSA-2gxp-6r36-m97r https://github.com/advisories/GHSA-2gxp-6r36-m97r
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L Found at https://github.com/pypa/advisory-database/tree/main/vulns/cadwyn/PYSEC-2025-71.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L Found at https://github.com/zmievsa/cadwyn
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L Found at https://github.com/zmievsa/cadwyn/blob/5.4.3/CHANGELOG.md#543
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L Found at https://github.com/zmievsa/cadwyn/commit/b424ecd57cd8dabbc8fe39b8f8ccafea629c7728
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L Found at https://github.com/zmievsa/cadwyn/security/advisories/GHSA-2gxp-6r36-m97r
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2025-53528
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-02T04:23:17.476365+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/cadwyn/PYSEC-2025-71.yaml 38.6.0