Read the docs
TI-2025-16849 Aliases CVE-2025-23039

Cross Site Scripting on URL decode Tooltip in Caido

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Caido is a web security auditing toolkit. A Cross-Site Scripting (XSS) vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute arbitrary scripts, potentially leading to the theft of sensitive information. This issue has been addressed in version 0.45.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00238 14th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
caidocaido= 0.45.0—No fix listedCNA
  • caido Vendorcaido Affected = 0.45.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-23039

References

Other 1

  • TI-2026-20052 Caido has an insufficient patch for DNS rebind leading to RCE CVSS 3.1CRITICAL 9.8
  • TI-2025-31132 Hijacking Caido instance during the initial setup via DNS Rebinding to achieve RCE CVSS 3.1HIGH 7.5
  • TI-2025-33726 Caido Toast Vulnerable to Reflected Cross-site Scripting CVSS 3.1MEDIUM 6.3
  • TI-2025-40551 Caido Improperly Handles External Links in Markdown CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences