High, CVSS 7.6PyPIAmendedPublished
Cadwyn vulnerable to XSS on the docs page
CVE-2025-53528 · GHSA-2gxp-6r36-m97r
- Affected
- PyPI cadwyn < 5.4.3
- Fixed in
- 5.4.3· Vendor fix available
- Issue
- The version parameter of the /docs endpoint is vulnerable to a Reflected XSS (Cross-Site Scripting) attack. PoC 1. Setup a minimal app following the quickstart guide: https://docs.cadwyn.dev/quickstart/setup/ 2. Click on the following PoC link: http://localhost:8000/docs?version=%27%2balert(document.domain)%2b%27 Impact Refer to this security advisory for an example of the impact of a similar vulnerability that shares the same root cause. This XSS would notably allow an attacker to execute JavaScript code on a user's session for any application based on Cadwyn via a one-click attack. A CVSS for the average case may be: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L Details The vulnerable code snippet can be found in the 2 functions swaggerdashboard and redocdashboard: https://github.com/zmievsa/cadwyn/blob/main/cadwyn/applications.py#L387-L413 The implementation uses the getswaggeruihtml function from FastAPI. This function does not encode or sanitize its arguments before using…
Recommended action: Upgrade to 5.4.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.