CVE-2025-2361: Mercurial SCM Web Interface cross site scripting
First published: Mon Mar 17 2025(Updated: )
A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mercurial |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-2361?
CVE-2025-2361 has been declared as a problematic vulnerability due to its potential for cross site scripting.
How does CVE-2025-2361 exploit remote code execution?
CVE-2025-2361 exploits an argument manipulation in the Web Interface component, allowing cross site scripting attacks to be initiated remotely.
What components are affected by CVE-2025-2361?
CVE-2025-2361 affects the Web Interface component of Mercurial SCM versions 4.5.3 and 71.19.145.211.
How can organizations mitigate CVE-2025-2361?
Organizations can mitigate CVE-2025-2361 by updating to the latest version of Mercurial SCM that resolves this vulnerability.
Is CVE-2025-2361 actively being exploited in the wild?
While specific exploitation reports for CVE-2025-2361 are not detailed, the nature of the vulnerability suggests it could be targeted by attackers.
- agent/weakness
- agent/title
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- agent/severity
- agent/event
- collector/oss-sec
- source/oss-sec
- alias/CVE-2025-2361
- agent/source
- agent/trending
- agent/references
- agent/last-modified-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- vendor/mercurial
- canonical/mercurial