{"id":"CVE-2025-67202","aliases":["EUVD-2025-209725","GHSA-xv9c-mjw8-79gf"],"status":"published","title":"Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL","description":"Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erb.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00194,"percentile":0.09156,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-05-07T00:00:00Z","modified":"2026-11-04T20:10:00Z","fixes":[{"ecosystem":"RubyGems","package":"sidekiq-cron","fixed_in":["2.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"sidekiq-cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"sidekiq-cron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}],"versions":["0.1.0","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.5.0","0.5.1","0.6.0","0.6.1","0.6.2","0.6.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.10.0","1.10.1","1.11.0","1.12.0","1.2.0","1.3.0","1.4.0","1.5.0","1.5.1","1.6.0","1.7.0","1.8.0","1.9.0","1.9.1","2.0.0","2.0.0.rc1","2.0.0.rc2","2.0.1","2.1.0","2.2.0","2.3.0","2.3.1"]}],"references":[{"url":"https://github.com/sidekiq-cron/sidekiq-cron/issues/569","tags":["exploit","report","web"]},{"url":"https://github.com/sidekiq-cron/sidekiq-cron/releases/tag/v2.4.0","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67202","tags":["advisory"]},{"url":"https://github.com/sidekiq-cron/sidekiq-cron/pull/568","tags":["web"]},{"url":"https://github.com/sidekiq-cron/sidekiq-cron/commit/7b4ae4822f93ef4646f5cb55500ca4e25662db7c","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sidekiq-cron/CVE-2025-67202.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xv9c-mjw8-79gf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67202.json","tags":["advisory"]},{"url":"https://github.com/sidekiq-cron/sidekiq-cron","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-67202","description":"Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erb.","status":"published","published":"2026-05-07T00:00:00Z","modified":"2026-05-08T22:16:51.261Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:52.21763Z"}],"euvd":[{"id":"EUVD-2025-209725","description":"Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erb.","status":"published","published":"2026-05-07T00:00:00Z","modified":"2026-05-08T22:16:51Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:05:14.089367Z"}],"ghsa":[{"id":"GHSA-xv9c-mjw8-79gf","title":"Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL","description":"Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erb.","status":"published","published":"2026-05-07T15:38:41Z","modified":"2026-05-29T21:45:47Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:15.638885Z"}],"nvd":[{"id":"CVE-2025-67202","description":"Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erb.","status":"published","published":"2026-05-07T15:16:04.947Z","modified":"2026-11-04T20:10:00.263Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-04T21:42:30.204668Z"}],"osv":[{"id":"CVE-2025-67202","description":"Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erb.","status":"published","published":"2026-05-07T00:00:00Z","modified":"2026-11-05T21:16:02.059437221Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T22:00:58.054534Z"},{"id":"GHSA-xv9c-mjw8-79gf","title":"Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL","description":"Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erb.","status":"published","published":"2026-05-07T15:38:41Z","modified":"2026-05-29T22:00:14.621971136Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:47:00.604718Z"}]}}