CVE-2025-53834mediumCWE-79

CVE-2025-53834: medium-severity vulnerability in caido

Caido Toast Vulnerable to Reflected Cross-site Scripting

Published · Updated

Follow this CVE+ Monitor caido

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.3%
Caido is a web security auditing toolkit. A reflected cross-site scripting (XSS) vulnerability was discovered in Caido’s toast UI component in versions prior to 0.49.0. Toast messages may reflect unsanitized user input in certain tools such as Match&Replace and Scope. This could allow an attacker to craft input that results in arbitrary script execution. Version 0.49.0 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected products
caido · caido
Related CVEs — caido

In the same product, most dangerous first.

CVE-2025-49004HIGHHijacking Caido instance during the initial setup via DNS Rebinding to achieve RCEEPSS 0.7%CVE-2026-24853HIGHCaido has an insufficient patch for DNS rebind leading to RCEEPSS 0.3%CVE-2025-23039MEDIUMCross Site Scripting on URL decode Tooltip in CaidoEPSS 0.2%CVE-2025-66025MEDIUMCaido Improperly Handles External Links in MarkdownEPSS 0.2%