{"id":"CVE-2025-2361","aliases":["ALPINE-CVE-2025-2361","BELL-CVE-2025-2361","DEBIAN-CVE-2025-2361","DLA-4094-1","DSA-5883-1","EUVD-2025-6461","GHSA-4hg3-3xxj-v749","MGASA-2025-0120","OESA-2026-2729","OESA-2026-2730","OESA-2026-2731","SUSE-SU-2025:1054-1","UBUNTU-CVE-2025-2361","openSUSE-SU-2025:14912-1"],"status":"published","title":"Mercurial SCM Web Interface cross site scripting","description":"A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00521,"percentile":0.44599,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-94"],"published":"2025-03-17T04:31:03Z","modified":"2026-11-03T06:32:13Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"mercurial","fixed_in":["6.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"mercurial","fixed_in":["6.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"mercurial","fixed_in":["6.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"mercurial","fixed_in":["6.9.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"mercurial","fixed_in":["6.3.1-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"mercurial","fixed_in":["6.9.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mercurial","fixed_in":["6.3.2-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mercurial","fixed_in":["6.9.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mercurial","fixed_in":["6.9.4-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"mercurial","fixed_in":["5.6.1-4+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"mercurial","fixed_in":["6.5.1-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"mercurial","fixed_in":["5.6.1-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"mercurial","fixed_in":["6.6.1-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"mercurial","fixed_in":["5.1-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"mercurial","fixed_in":["5.9.1-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"mercurial","fixed_in":["5.9.1-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"mercurial","fixed_in":["5.9.1-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"mercurial","fixed_in":["5.9.1-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"mercurial","fixed_in":["5.9.1-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"mercurial","fixed_in":["5.9.1-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"mercurial","fixed_in":["5.9.1-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"mercurial","fixed_in":["5.9.1-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"mercurial","fixed_in":["5.9.1-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"mercurial","fixed_in":["5.9.1-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"mercurial","fixed_in":["5.9.1-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"mercurial","fixed_in":["5.9.1-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mercurial","fixed_in":["6.9.4-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.1-r1"},{"fixed":"6.3.1-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.9.1-r1"},{"fixed":"6.9.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-1+deb12u1"}]}],"versions":["6.3.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-4+deb11u1"}]}],"versions":["5.6.1-4"]},{"source":"osv","ecosystem":"Debian:12","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-1+deb12u1"}]}],"versions":["6.3.2-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.1-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.3-1","2.7.2-1","2.8.1-2","2.8.2-1ubuntu1","2.8.2-1ubuntu1.3","2.8.2-1ubuntu1.4","2.8.2-1ubuntu1.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4-1ubuntu2","3.6.2-1ubuntu2","3.7.3-1ubuntu1","3.7.3-1ubuntu1.1","3.7.3-1ubuntu1.2","3.7.3-1ubuntu1.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.1-2","4.5-1ubuntu1","4.5.2-0ubuntu2","4.5.3-1ubuntu2","4.5.3-1ubuntu2.1","4.5.3-1ubuntu2.1+esm2","4.5.3-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.2-1ubuntu4","4.8.2-1ubuntu5","5.2.1-1","5.2.2-1ubuntu2","5.2.2-1ubuntu3","5.2.2-1ubuntu4","5.3.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.1-4","5.6.1-4build1","5.9.3-1","6.0-1","6.0.1-1","6.1.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.4-2","6.5.2-2ubuntu3","6.5.3-1","6.6.1-2","6.7.2-1ubuntu2","6.7.2-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.4-1","7.0.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2-3build1","7.2.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.1-2","7.1.1-1ubuntu1","7.2-3","7.2-3build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.4-1.1"}]}]}],"products":[{"vendor":"mercurial","product":"scm"}],"references":[{"url":"https://vuldb.com/?id.299860","tags":["vdb-entry","technical-description","web","report"]},{"url":"https://vuldb.com/?ctiid.299860","tags":["signature","permissions-required","web","report"]},{"url":"https://vuldb.com/?submit.514024","tags":["third-party-advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/21/2","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00020.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2361","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4hg3-3xxj-v749"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-2361","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-2361","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-2361","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0120.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34129","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/03/21/2","tags":["web"]},{"url":"https://lists.mercurial-scm.org/pipermail/mercurial-packaging/2025-March/000754.html","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2025/msg00045.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2729","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2730","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2731","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251054-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239685","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2361","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-2361","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-2361","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/H7QQ7JKP3S6E5XRTMMKTYBVB6TBQ55DU/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-2361","title":"Mercurial SCM Web Interface cross site scripting","description":"A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-03-17T04:31:03.639Z","modified":"2025-03-27T21:02:46.983Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"},{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","assessor":"cna"}],"cwes":["CWE-79","CWE-94"],"updated_at":"2026-11-02T14:32:38.351095Z"}],"euvd":[{"id":"EUVD-2025-6461","description":"A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-03-17T04:31:03Z","modified":"2025-03-27T21:02:46Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:52:48.662755Z"}],"ghsa":[{"id":"GHSA-4hg3-3xxj-v749","title":"A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as...","description":"A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-03-17T06:30:25Z","modified":"2025-03-27T21:32:22Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:00:30.356167Z"}],"nvd":[{"id":"CVE-2025-2361","description":"A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-03-17T05:15:36.713Z","modified":"2026-06-17T09:06:50Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79","CWE-94"],"updated_at":"2026-11-02T14:10:54.744127Z"}],"osv":[{"id":"ALPINE-CVE-2025-2361","description":"A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-03-17T05:15:36.713Z","modified":"2026-11-03T06:32:13.304132416Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"BELL-CVE-2025-2361","status":"published","published":"2025-03-18T05:58:45.801672Z","modified":"2026-01-26T09:38:56.614114Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:21.491466Z"},{"id":"DEBIAN-CVE-2025-2361","description":"A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-03-17T05:15:36.713Z","modified":"2026-09-01T20:05:44.5874953Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"OESA-2026-2729","title":"mercurial security update","description":"Mercurial is a free, distributed source control management tool. It efficiently handles projects of any size and offers an easy and intuitive interface.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.(CVE-2025-2361)","status":"published","published":"2026-06-24T11:11:39Z","modified":"2026-08-18T01:21:10.787224239Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2730","title":"mercurial security update","description":"Mercurial is a free, distributed source control management tool. It efficiently handles projects of any size and offers an easy and intuitive interface.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.(CVE-2025-2361)","status":"published","published":"2026-06-24T11:11:39Z","modified":"2026-08-18T01:21:10.992362699Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2731","title":"mercurial security update","description":"Mercurial is a free, distributed source control management tool. It efficiently handles projects of any size and offers an easy and intuitive interface.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.(CVE-2025-2361)","status":"published","published":"2026-06-24T11:11:39Z","modified":"2026-08-18T01:21:11.004981788Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"UBUNTU-CVE-2025-2361","description":"A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-03-17T05:15:00Z","modified":"2026-10-17T12:56:48.927422976Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"CVE-2025-2361","description":"A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-03-17T05:15:36Z","modified":"2026-04-16T04:37:18.20508071Z","updated_at":"2026-11-02T15:44:47.009967Z"},{"id":"DLA-4094-1","title":"mercurial - security update","status":"published","published":"2025-03-27T00:00:00Z","modified":"2026-03-09T01:23:03.388687Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5883-1","title":"mercurial - security update","status":"published","published":"2025-03-22T00:00:00Z","modified":"2026-03-09T02:11:42.501378Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2025-0120","title":"Updated mercurial packages fix security vulnerability","description":"Mercurial SCM Web Interface cross site scripting. (CVE-2025-2361)\n","status":"published","published":"2025-03-31T15:54:01Z","modified":"2026-04-16T04:43:39.686723185Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:14912-1","title":"mercurial-6.9.4-1.1 on GA media","description":"These are all security issues fixed in the mercurial-6.9.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-20T00:00:00Z","modified":"2026-02-04T04:27:26.422264Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:1054-1","title":"Security update for mercurial","description":"This update for mercurial fixes the following issues:\n\n- CVE-2025-2361: Fixed improper sanitization of user-controlled input passed via the cmd parameter in the Mercurial SCM Web Interface (bsc#1239685)\n","status":"published","published":"2025-03-28T16:54:30Z","modified":"2026-02-04T03:35:17.725555Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}