Roundup is vulnerable to XSS through interactions between URLs and issue tracker templates

MEDIUM 6.4CVE-2025-53865 · GHSA-qxh9-qmf2-rhwc · PYSEC-2025-69 · Published 13/07/2025 · updated 17/06/2026

In short

CVE-2025-53865 is a MEDIUM (CVSS 6.4) vulnerability affecting roundup.
Chance of exploitation in the next 30 days (EPSS): 0.22%, higher than 12.2% of all vulnerabilities.
Fix: update to 2.5.0 or later.

Package	Affected versions	Patched versions
roundup PyPI	`< 2.5.0`	`2.5.0`

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).

NVD description

In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

< 2.5.0

2.5.0

More vulnerabilities in roundup

See all →