PT-2025-44311 · Ckan · Ckan

Published 2025-10-29 · Updated 2025-10-29 · CVE-2025-54384

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions CKAN versions prior to 2.10.9 CKAN versions prior to 2.11.4

Description CKAN, an open-source data management system, contains a flaw in the helpers.markdown extract() function. Insufficient input sanitization before wrapping data in an HTML literal element can lead to a potential cross-site scripting (XSS) vector. This impacts the rendering of user-provided data on dataset, resource, organization, or group pages, as well as pages provided by extensions utilizing this helper function.

Recommendations Update to CKAN version 2.10.9 or later. Update to CKAN version 2.11.4 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-54384

GHSA-2R4H-8JXV-W2J8

Affected Products

Ckan

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54384.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-54384 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2r4h-8jxv-w2j8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54384 · Security Note
• https://github.com/ckan/ckan · Note
• https://github.com/ckan/ckan/commit/6d0065f2fc7e2682196d125275af34b93e9e554e · Note
• https://github.com/ckan/ckan/security/advisories/GHSA-2r4h-8jxv-w2j8 · Note
• https://github.com/ckan/ckan/commit/112affffa74b14fc97c54abcf18315df97114917 · Note
• https://github.com/ckan/ckan/releases/tag/ckan-2.11.4 · Note
• https://github.com/ckan/ckan/releases/tag/ckan-2.10.9 · Note
• https://t.me/cveNotify/140855 · Telegram Post
• https://twitter.com/CVEnew/status/1983563345358623219 · Twitter Post
• https://t.me/CVEtracker/36073 · Telegram Post