medium6.4
CVE-2025-53865
Roundup is vulnerable to XSS through interactions between URLs and issue tracker templates
Impact
In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | roundup | < 2.5.0 | 2.5.0 |
Affected products
| Product | Affected versions |
|---|---|
| Roundup | before 2.5.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://www.roundup-tracker.org/docs/security.html
- https://www.roundup-tracker.org/docs/upgrading.html#cve-2025-53865
- https://github.com/advisories/GHSA-qxh9-qmf2-rhwc
- https://nvd.nist.gov/vuln/detail/CVE-2025-53865
- https://github.com/roundup-tracker/roundup/commit/3b1f22f331d4798491bd4746dbaaa6cfbe972952
- https://github.com/roundup-tracker/roundup/commit/65ac8f4dcb03a9a36a67c3e98fdf79cbd2a0b3fb
- https://github.com/pypa/advisory-database/tree/main/vulns/roundup/PYSEC-2025-69.yaml