CVE-2025-56154

6.1 mediumEPSS 0.3%

Medium (6.1) in htmly htmly. EPSS 0.3% chance of exploitation in the next 30 days.

htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The name parameter is not properly sanitized before being reflected in the HTML response, allowing attackers to inject arbitrary JavaScript payloads.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-10-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

htmly:htmly

References

https://gist.github.com/akinerkisa/28e97fa132b1a98cff5d05a79b437901
https://github.com/danpros/htmly/releases/tag/v3.0.9#:~:text=Security%20fixes%20found%20in%20version%203.0.8
https://pastebin.com/dVityKmU

Check your stack JSON