Caido Toast Vulnerable to Reflected Cross-site Scripting
Priority LOW 28CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Caido is a web security auditing toolkit. A reflected cross-site scripting (XSS) vulnerability was discovered in Caido’s toast UI component in versions prior to 0.49.0. Toast messages may reflect unsanitized user input in certain tools such as Match&Replace and Scope. This could allow an attacker to craft input that results in arbitrary script execution. Version 0.49.0 fixes the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00256 17th percentileScored 2026-11-07
Fix Fixed caido (caido): 0.49.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA caido (caido) Fixed in 0.49.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-53834
References
More caido vulnerabilities
- TI-2026-20052 Caido has an insufficient patch for DNS rebind leading to RCE CVSS 3.1CRITICAL 9.8
- TI-2025-31132 Hijacking Caido instance during the initial setup via DNS Rebinding to achieve RCE CVSS 3.1HIGH 7.5
- TI-2025-16849 Cross Site Scripting on URL decode Tooltip in Caido CVSS 3.1MEDIUM 5.2
- TI-2025-40551 Caido Improperly Handles External Links in Markdown CVSS 3.1MEDIUM 4.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences