CVSS 3.1
7.6 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:LCVE-2025-53528
High (7.6). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in cadwyn 5.4.3.
Cadwyn creates production-ready community-driven modern Stripe-like API versioning in FastAPI. In versions before 5.4.3, the version parameter of the "/docs" endpoint is vulnerable to a Reflected XSS (Cross-Site Scripting) attack. This XSS would notably allow an attacker to execute JavaScript code on a user's session for any application based on Cadwyn via a one-click attack. The vulnerability has been fixed in version 5.4.3.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2gxp-6r36-m97r | PyPI | cadwyn | <5.4.3 | 5.4.3 |
| PYSEC-2025-71 | PyPI | cadwyn | <5.4.3 | 5.4.3 |