CVE-2025-23039

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-23039
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-23039.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-23039
Aliases
  • GHSA-3mfw-fhfp-mgrv
Published
2025-01-17T20:13:13.156Z
Modified
2026-04-10T05:24:00.354532Z
Severity
  • 5.2 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Cross Site Scripting on URL decode Tooltip in Caido
Details

Caido is a web security auditing toolkit. A Cross-Site Scripting (XSS) vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute arbitrary scripts, potentially leading to the theft of sensitive information. This issue has been addressed in version 0.45.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23039.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/caido/caido

Affected ranges

Type
GIT
Repo
https://github.com/caido/caido
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
67187730719521d627f411008f6e9f6379f86814
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "= 0.45.0"
        }
    ]
}

Affected versions

v0.*
v0.22.1
v0.23.1
v0.24.0
v0.24.1
v0.25.0
v0.25.3
v0.26.0
v0.27.1
v0.27.2
v0.28.0
v0.29.0
v0.29.2
v0.30.0
v0.30.1
v0.30.2
v0.30.3
v0.30.4
v0.31.0
v0.31.1
v0.32.0
v0.32.1
v0.33.0
v0.34.0
v0.34.1
v0.35.0
v0.36.0
v0.36.1
v0.37.0
v0.38.0
v0.39.0
v0.40.0
v0.41.0
v0.42.0
v0.43.0
v0.43.1
v0.44.0
v0.44.1
v0.45.0
v0.45.1
v0.46.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-23039.json"