HashiCorp Consul Cross-site Scripting vulnerability

MEDIUM 6.1CVE-2020-25864 · BIT-consul-2020-25864 · GHSA-8xmx-h8rq-h94j · Published 20/04/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/hashicorp/consul Go	`≥ 1.8.0, < 1.8.10≥ 1.9.0, < 1.9.5< 1.7.14`	`1.8.101.9.51.7.14`
consul hashicorp	`≥ 1.8.0, < 1.8.10≥ 1.9.0, < 1.9.5< 1.7.14`	`1.8.101.9.51.7.14`

Description

HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.

NVD description

HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.

References

nvd.nist.gov/vuln/detail/CVE-2020-25864 · ADVISORY
discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368 · WEB
hashicorp/consul · PACKAGE
security.gentoo.org/glsa/202208-09 · WEB
hashicorp.com/blog/category/consul · WEB
GitHub Advisory GHSA-8xmx-h8rq-h94j · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free