PT-2025-40403 · Htmly · Htmly

Akinerkisa · Published 2025-10-02 · Updated 2026-01-20 · CVE-2025-56154

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions htmly version 3.0.8

Description The application is susceptible to Cross Site Scripting (XSS) due to insufficient sanitization of user-supplied input. Specifically, the /author/:name API endpoint does not properly sanitize the name parameter before reflecting it in the HTML response. This allows attackers to inject arbitrary JavaScript payloads.

Recommendations Apply proper input sanitization to the name parameter in the /author/:name endpoint.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-56154

Affected Products

Htmly

References · 9

• https://osv.dev/vulnerability/CVE-2025-56154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-56154 · Security Note
• https://github.com/danpros/htmly/releases/tag/v3.0.9#:~:text=Security%20fixes%20found%20in%20version%203.0.8 · Note
• https://t.me/CVEtracker/33955 · Telegram Post
• https://gist.github.com/akinerkisa/28e97fa132b1a98cff5d05a79b437901 · Note
• https://twitter.com/VulmonFeeds/status/1973803861618950253 · Twitter Post
• https://t.me/cveNotify/149307 · Telegram Post
• https://twitter.com/CVEnew/status/1973791452691067255 · Twitter Post
• https://pastebin.com/dVityKmU · Note