CVE-2025-54057 json
Apache SkyWalking: Stored XSS vulnerability
published 2025-11-27 11 mo ago modified 2026-10-18 21 d ago also EUVD-2025-199821 , GHSA-v6x2-4q87-rf82
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking.
This issue affects Apache SkyWalking: <= 10.2.0.
Users are recommended to upgrade to version 10.3.0, which fixes the issue.
Patch / fix
- apache skywalking 10.3.0
- org.apache.skywalking apm-webapp 10.3.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 11 mo ago
Exploit prediction
0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.skywalking:apm-webapp | <=10.1.0 |
no fix listed |
Affected products
- Apache Software Foundation Apache SkyWalking
Classification
- Weakness
-
- CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page
References
-
lists.apache.org
/thread/sl2x2tx8y007x0mo746yddx2lvnv9tcr
vendor-advisory, web
-
openwall.com
/lists/oss-security/2025/11/27/1
web, mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2026/04/13/3
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-54057
advisory
-
github.com
/apache/skywalking
package
Sources
- CVE List CVE-2025-54057
- GitHub Advisory GHSA-v6x2-4q87-rf82
- NVD CVE-2025-54057
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.