CVE-2025-53528: Cadwyn XSS Vulnerability in Docs Page
Summary
CVE-2025-53528: Cadwyn vulnerable to XSS on the docs page. Affects cadwyn versions < 5.4.3. Fixed in 5.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cadwyn is an open-source framework designed for building APIs with a focus on simplicity and ease of use. It leverages FastAPI to provide a user-friendly interface for API documentation. However, it is susceptible to a reflected Cross-Site Scripting (XSS) vulnerability that can be exploited through the 'version' parameter in the '/docs' endpoint.
Vulnerability Detail
The vulnerability arises from the improper handling of user-supplied input in the 'version' parameter of the '/docs' endpoint. This allows attackers to inject malicious JavaScript code, which can be executed in the context of the user's session. The root cause is the use of the get_swagger_ui_html function from FastAPI, which does not sanitize or encode its arguments. An attacker can exploit this vulnerability by crafting a URL that includes a payload, leading to potential data theft or session hijacking.
How To Fix
Minimum fixed version
5.4.3
This is the first release that contains the fix.
pip install --upgrade "cadwyn==5.4.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'version' parameter in the '/docs' endpoint until the package is updated. Additionally, consider implementing input validation and sanitization in your application to prevent XSS attacks.
Conclusion
The Cadwyn framework is vulnerable to a reflected XSS attack through the '/docs' endpoint due to improper handling of user input. It is crucial to update to version 5.4.3 or later to mitigate this risk. Implementing input validation and using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for cadwyn →
FAQ
CVE-2025-53528 is a vulnerability in the Cadwyn framework that allows for reflected XSS attacks through the '/docs' endpoint.
An attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of a user's session, potentially leading to data theft or session hijacking.
Yes, the vulnerability has been patched in Cadwyn version 5.4.3. It is recommended to update to this version or later.
If you cannot update immediately, avoid using the 'version' parameter in the '/docs' endpoint and implement input validation to mitigate the risk.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application against known vulnerabilities using the Vulert playground without any signup.
