CVE-2025-56154: XSS
htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The name parameter is not properly sanitized before being reflected in the HTML response, allowing attackers to inject arbitrary JavaScript payloads.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-56154?
CVE-2025-56154 has been classified as a medium severity vulnerability due to its potential for exploitation through Cross Site Scripting.
How do I fix CVE-2025-56154?
To fix CVE-2025-56154, update to htmly version 3.0.9 or later where the XSS vulnerability in the /author/:name endpoint has been addressed.
What types of attacks are possible with CVE-2025-56154?
CVE-2025-56154 allows attackers to perform Cross Site Scripting attacks, potentially injecting arbitrary JavaScript into user sessions.
Does CVE-2025-56154 affect earlier versions of htmly?
Yes, CVE-2025-56154 specifically affects htmly version 3.0.8 and earlier versions.
Are there any specific mitigations for CVE-2025-56154 besides updating?
In addition to updating, input validation and proper sanitization can be implemented in custom code to help mitigate XSS vulnerabilities.