CVE-2025-53865: Roundup Package Vulnerable to XSS via URL and Template Interaction
Summary
CVE-2025-53865: Roundup is vulnerable to XSS through interactions between URLs and issue tracker templates. Affects roundup versions < 2.5.0. Fixed in 2.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Roundup is an open-source issue-tracking system that allows users to manage and track issues effectively. It provides features such as customizable issue templates, user management, and a web interface for easy access. However, prior to version 2.5.0, Roundup is susceptible to Cross-Site Scripting (XSS) vulnerabilities, particularly through interactions between URLs and issue tracker templates, which can compromise user data and application integrity.
Vulnerability Detail
The vulnerability arises from improper handling of user input in URLs and issue tracker templates within Roundup. Attackers can exploit this flaw to inject malicious scripts into web pages viewed by other users. This could lead to unauthorized actions, data theft, or session hijacking, significantly impacting the security of the application and its users.
How To Fix
Latest published version: 2.6.0 as of 22 Oct 2026
pip install --upgrade "roundup==2.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5.0
This is the first release that contains the fix.
pip install --upgrade "roundup==2.5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can sanitize input data and validate URLs before processing them in the application. This can help reduce the risk of XSS attacks until the package is updated. Implementing Content Security Policy (CSP) headers can also provide an additional layer of security.
Conclusion
In summary, CVE-2025-53865 represents a significant XSS vulnerability in the Roundup package, affecting its security through improper URL handling. Users are strongly encouraged to update to version 2.5.0 or later to protect against potential exploits. Utilizing tools like Vulert can further enhance security by providing real-time vulnerability monitoring.
See every vulnerability recorded for roundup →
FAQ
CVE-2025-53865 is a vulnerability in the Roundup package that allows for Cross-Site Scripting (XSS) attacks through improper handling of URLs and issue tracker templates.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your Pipfile.lock without needing to sign up.
Exploiting this vulnerability can lead to unauthorized access, data theft, and session hijacking, compromising user security and application integrity.
Yes, the vulnerability is fixed in Roundup version 2.5.0. Users are advised to upgrade to this version to mitigate the risk.
The CVSS score for this vulnerability is 6.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for roundup.
