EUVD-2025-209725
GHSA-xv9c-mjw8-79gf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS; no attacker privileges needed, victim click required, scope changes to browser context; no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erb.
AnalysisAI
Reflected cross-site scripting in Sidekiq-cron through v2.3.1 allows network-based attackers to execute arbitrary JavaScript in the browser of an authenticated Sidekiq web UI user by crafting a malicious URL that is rendered unsanitized by the cron.erb template. A POC exists per SSVC data, though EPSS sits at effectively 0% and the vulnerability is not in CISA KEV, suggesting exploitation remains opportunistic rather than widespread. The fix is confirmed in v2.4.0 via PR #568.
Technical ContextAI
Sidekiq-cron is a Ruby gem that adds cron-style job scheduling to Sidekiq, a widely used background job processing library for Ruby/Rails applications. The gem extends Sidekiq's built-in Rack/Sinatra-based web UI with its own views, including cron.erb, which renders job scheduling information. The vulnerability (CWE-79, Improper Neutralization of Input During Web Page Generation) arises because URL-derived input is reflected into the cron.erb template response without proper HTML encoding or sanitization, making it a classic reflected XSS. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C confirms network delivery, low complexity, no attacker privileges required, mandatory victim interaction, and a scope change - the latter because the injected script executes in the victim's browser context rather than on the server. NVD has not yet assigned a formal CPE entry (listed as cpe:2.3:a:n/a:n/a), but the affected artifact is the sidekiq-cron RubyGem. Red Hat is tagged as a stakeholder, suggesting potential downstream advisory impact.
RemediationAI
The primary remediation is upgrading sidekiq-cron to v2.4.0 or later, which contains the fix introduced via PR #568 ('Fix reflected XSS on Sidekiq-UI'). Update your Gemfile to require 'sidekiq-cron' '>= 2.4.0' and run 'bundle update sidekiq-cron'. Release notes and the fix are confirmed at https://github.com/sidekiq-cron/sidekiq-cron/releases/tag/v2.4.0. If immediate patching is not feasible, a compensating control is to restrict network access to the Sidekiq web UI to trusted internal IP ranges or require VPN authentication, which eliminates the attacker's ability to deliver crafted URLs to victims; the trade-off is reduced operational accessibility for remote administrators. Ensuring the Sidekiq web UI is protected by strong authentication middleware (e.g., Devise, HTTP Basic Auth with strong credentials) narrows the victim pool but does not eliminate the vulnerability, since authenticated users remain exploitable.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today