CVE-2025-53865

Roundup is vulnerable to XSS through interactions between URLs and issue tracker templates

6.4 MediumFix available

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.21%Up 0.2 points since Jul 14, 2025

What each source reports

CVE List Score used 6.4

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).

Record: CVE-2025-53865
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2025-21265 6.4

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).

Record: EUVD-2025-21265
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-qxh9-qmf2-rhwc 6.4

Roundup is vulnerable to XSS through interactions between URLs and issue tracker templates

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).

Record: GHSA-qxh9-qmf2-rhwc
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 6.4

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).

Record: CVE-2025-53865
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-qxh9-qmf2-rhwc 6.4

Roundup is vulnerable to XSS through interactions between URLs and issue tracker templates

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).

Record: GHSA-qxh9-qmf2-rhwc
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-53865 6.4

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).

Record: UBUNTU-CVE-2025-53865
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVPYSEC-2025-69 No score

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).

Record: PYSEC-2025-69
Updated: 2026-11-02

Affected products

roundup-tracker roundup

Affected packages

Affected packages
Package	Affected	Fixed
`roundup` PyPI	before 2.5.0	2.5.0
`roundup` PyPI	before 2.5.0, plus listed versions 0.5.90.6.110.6.80.6.90.7.0 Show 45 moreShow less 0.7.0b30.7.10.7.110.7.120.7.20.7.30.7.40.7.50.7.70.7.80.7.90.8.00.8.0b10.8.10.8.20.8.30.8.40.8.50.8.60.9.0b11.01.0.11.1.01.1.11.1.21.2.01.2.11.3.01.3.11.3.21.3.31.4.01.4.11.4.101.4.111.4.121.4.131.4.141.4.151.4.161.4.171.4.181.4.191.4.21.4.20	2.5.0
`roundup` Ubuntu:16.04:LTS	All versions, plus listed versions 1.4.20-1.11.4.20-1.1+deb8u1build0.16.04.11.4.20-1.1+deb8u2build0.16.04.1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-53865 is a medium vulnerability (CVSS 6.4) in Roundup-tracker Roundup, published July 13, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in roundup 2.5.0.

References

Show 4 moreShow less

This page doesn't list everything

Left out here: 25 versions. The JSON record has them.