Medium severity · published Jan 17, 2025
CVE-2025-23039
Cross Site Scripting on URL decode Tooltip in Caido
5.2
CVSS
0.2%
EPSS
No
On KEV
Description
Caido is a web security auditing toolkit. A Cross-Site Scripting (XSS) vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute arbitrary scripts, potentially leading to the theft of sensitive information. This issue has been addressed in version 0.45.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
caido · caido
= 0.45.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-23039
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-23039
github.com
https://github.com/caido/caido/security/advisories/GHSA-3mfw-fhfp-mgrv
More from caido
9.8
CVE-2026-24853
Caido has an insufficient patch for DNS rebind leading to RCE
7.5
CVE-2025-49004
Hijacking Caido instance during the initial setup via DNS Rebinding to achieve RCE
6.3
CVE-2025-53834
Caido Toast Vulnerable to Reflected Cross-site Scripting
4.3
CVE-2025-66025
Caido Improperly Handles External Links in Markdown