CVE-2025-53865

6.4 mediumEPSS 0.2%

Medium (6.4). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in roundup 2.5.0.

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).

Severity

6.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-07-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-qxh9-qmf2-rhwc	PyPI	roundup	<2.5.0	2.5.0
PYSEC-2025-69	PyPI	roundup	<2.5.0	2.5.0