CVE-2025-2361
Mercurial SCM Web Interface cross site scripting
A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Mercurial SCM Web Interface cross site scripting
A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
CVE-2025-2361- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-79, CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2025-6461
A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
EUVD-2025-6461- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4hg3-3xxj-v749
A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as...
A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
GHSA-4hg3-3xxj-v749- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
CVE-2025-2361- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-79, CWE-94
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-2361
A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
ALPINE-CVE-2025-2361- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-03
OSVBELL-CVE-2025-2361
- Record
BELL-CVE-2025-2361- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2025-2361
A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
DEBIAN-CVE-2025-2361- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVOESA-2026-2729
mercurial security update
Mercurial is a free, distributed source control management tool. It efficiently handles projects of any size and offers an easy and intuitive interface.
Security Fix(es):
A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.(CVE-2025-2361)
- Record
OESA-2026-2729- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-2730
mercurial security update
Mercurial is a free, distributed source control management tool. It efficiently handles projects of any size and offers an easy and intuitive interface.
Security Fix(es):
A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.(CVE-2025-2361)
- Record
OESA-2026-2730- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-2731
mercurial security update
Mercurial is a free, distributed source control management tool. It efficiently handles projects of any size and offers an easy and intuitive interface.
Security Fix(es):
A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.(CVE-2025-2361)
- Record
OESA-2026-2731- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-2361
A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
UBUNTU-CVE-2025-2361- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSV No score
A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
CVE-2025-2361- Updated
- 2026-11-02
OSVMGASA-2025-0120 No score
Updated mercurial packages fix security vulnerability
Mercurial SCM Web Interface cross site scripting. (CVE-2025-2361)
- Record
MGASA-2025-0120- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14912-1 No score
mercurial-6.9.4-1.1 on GA media
These are all security issues fixed in the mercurial-6.9.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14912-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1054-1 No score
Security update for mercurial
This update for mercurial fixes the following issues:
- CVE-2025-2361: Fixed improper sanitization of user-controlled input passed via the cmd parameter in the Mercurial SCM Web Interface (bsc#1239685)
- Record
SUSE-SU-2025:1054-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mercurialAlpine:v3.21 |
before 6.9.4-r0 | 6.9.4-r0 |
mercurialAlpine:v3.22 |
before 6.9.4-r0 | 6.9.4-r0 |
mercurialAlpine:v3.23 |
before 6.9.4-r0 | 6.9.4-r0 |
mercurialAlpine:v3.24 |
before 6.9.4-r0 | 6.9.4-r0 |
mercurialAlpaquita:23 |
6.3.1-r1 up to 6.3.1-r2 | 6.3.1-r2 |
mercurialAlpaquita:stream |
6.9.1-r1 up to 6.9.4-r0 | 6.9.4-r0 |
mercurialDebian:12 |
before 6.3.2-1+deb12u1, plus listed versions 6.3.2-1 |
6.3.2-1+deb12u1 |
mercurialDebian:13 |
before 6.9.4-1 | 6.9.4-1 |
mercurialDebian:14 |
before 6.9.4-1 | 6.9.4-1 |
mercurialDebian:11 |
before 5.6.1-4+deb11u1, plus listed versions 5.6.1-4 |
5.6.1-4+deb11u1 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mercurialMageia:9 |
before 6.5.1-1.1.mga9 | 6.5.1-1.1.mga9 |
mercurialopenEuler:22.03-LTS-SP4 |
before 5.6.1-2.oe2203sp4 | 5.6.1-2.oe2203sp4 |
mercurialopenEuler:24.03-LTS-SP1 |
before 6.6.1-2.oe2403sp1 | 6.6.1-2.oe2403sp1 |
mercurialopenEuler:20.03-LTS-SP4 |
before 5.1-4.oe2003sp4 | 5.1-4.oe2003sp4 |
mercurialSUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 5.9.1-150400.3.6.1 | 5.9.1-150400.3.6.1 |
mercurialSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 5.9.1-150400.3.6.1 | 5.9.1-150400.3.6.1 |
mercurialSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 5.9.1-150400.3.6.1 | 5.9.1-150400.3.6.1 |
mercurialSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 5.9.1-150400.3.6.1 | 5.9.1-150400.3.6.1 |
mercurialSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 5.9.1-150400.3.6.1 | 5.9.1-150400.3.6.1 |
mercurialSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 5.9.1-150400.3.6.1 | 5.9.1-150400.3.6.1 |
mercurialSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 5.9.1-150400.3.6.1 | 5.9.1-150400.3.6.1 |
mercurialSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 5.9.1-150400.3.6.1 | 5.9.1-150400.3.6.1 |
mercurialSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 5.9.1-150400.3.6.1 | 5.9.1-150400.3.6.1 |
mercurialSUSE:Manager Proxy 4.3 |
before 5.9.1-150400.3.6.1 | 5.9.1-150400.3.6.1 |
mercurialSUSE:Manager Server 4.3 |
before 5.9.1-150400.3.6.1 | 5.9.1-150400.3.6.1 |
mercurialopenSUSE:Leap 15.6 |
before 5.9.1-150400.3.6.1 | 5.9.1-150400.3.6.1 |
mercurialUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.6.3-12.7.2-12.8.1-22.8.2-1ubuntu12.8.2-1ubuntu1.32.8.2-1ubuntu1.42.8.2-1ubuntu1.4+esm1 |
None known |
mercurialUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.4-1ubuntu23.6.2-1ubuntu23.7.3-1ubuntu13.7.3-1ubuntu1.13.7.3-1ubuntu1.23.7.3-1ubuntu1.2+esm2 |
None known |
mercurialUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.3.1-24.5-1ubuntu14.5.2-0ubuntu24.5.3-1ubuntu24.5.3-1ubuntu2.14.5.3-1ubuntu2.1+esm24.5.3-1ubuntu2.2 |
None known |
mercurialUbuntu:20.04:LTS |
All versions, plus listed versions 4.8.2-1ubuntu44.8.2-1ubuntu55.2.1-15.2.2-1ubuntu25.2.2-1ubuntu35.2.2-1ubuntu45.3.1-1ubuntu1 |
None known |
mercurialUbuntu:22.04:LTS |
All versions, plus listed versions 5.6.1-45.6.1-4build15.9.3-16.0-16.0.1-16.1.1-1ubuntu1 |
None known |
mercurialUbuntu:24.04:LTS |
All versions, plus listed versions 6.4.4-26.5.2-2ubuntu36.5.3-16.6.1-26.7.2-1ubuntu26.7.2-1ubuntu2.2 |
None known |
mercurialUbuntu:25.10 |
All versions, plus listed versions 6.9.4-17.0.1-2 |
None known |
mercurialUbuntu:26.10 |
All versions, plus listed versions 7.2-3build17.2.4-1ubuntu1 |
None known |
mercurialUbuntu:26.04:LTS |
All versions, plus listed versions 7.0.1-27.1.1-1ubuntu17.2-37.2-3build1 |
None known |
mercurialopenSUSE:Tumbleweed |
before 6.9.4-1.1 | 6.9.4-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-2361 is a medium vulnerability (CVSS 5.3) in Mercurial Scm, published March 17, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in mercurial 6.9.4-r0.
References
vuldb.com?id.299860
openwall.com/lists/oss-security/2025/03/21/2
lists.debian.org/debian-lts-announce/2025/03/msg00020.html
nvd.nist.gov/vuln/detail/CVE-2025-2361
Show 17 moreShow less
github.com/advisories/GHSA-4hg3-3xxj-v749
security.alpinelinux.org/vuln/CVE-2025-2361
docs.bell-sw.com/security/cves/CVE-2025-2361
security-tracker.debian.org/tracker/CVE-2025-2361
advisories.mageia.org/MGASA-2025-0120.html
bugs.mageia.org/show_bug.cgi?id=34129
lists.mercurial-scm.org/pipermail/mercurial-packaging/2025-March/000754.html
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2729
suse.com/support/update/announcement/2025/suse-su-20251054-1
bugzilla.suse.com/1239685
ubuntu.com/security/CVE-2025-2361
cve.org/CVERecord?id=CVE-2025-2361
lists.opensuse.org/archives/list/[email protected]/thread/H7QQ7JKP3S6E5XRTMMKTYBVB6TBQ55DU