CVE-2025-53941 - CVE House

Status published Medium CVE-2025-53941

Hollo renders posts received with form elements and allows submission

6.1 CVSS

Vulnerability Description

Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Versions prior to 0.6.5 allow HTML form elements to be submitted, making the software vulnerable to HTML injection. Version 0.6.5 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53941

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from fedify-dev

View All →

CVE-2025-68475

Fedify has ReDoS Vulnerability in HTML Parsing Regex

High 7.5

CVE-2025-54888

@fedify/fedify: Improper Authentication and Incorrect Authorization

High 8.7

Affected Vendor

fedify-dev

View all reports →

Affected Software

hollo

Vulnerable Versions:

< 0.6.5

Timeline

Official Publish: July 17th, 2025

Last Modified: July 17th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

Initial Access

T1059.007 JavaScript

Execution

T1539 Steal Web Session Cookie

Collection

T1213 Data from Information Repositories