Hollo renders posts received with form elements and allows submission
Priority MEDIUM 60CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Versions prior to 0.6.5 allow HTML form elements to be submitted, making the software vulnerable to HTML injection. Version 0.6.5 fixes the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0027 19th percentileScored 2026-11-07
Fix Fixed hollo (fedify-dev): 0.6.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fedify-dev | hollo | before 0.6.5 | 0.6.5 | Patch available | CNA |
- hollo Vendorfedify-dev Affected before 0.6.5 Fixed in 0.6.5 Patch available CNA
Remediation
- Fix · CNA hollo (fedify-dev) Fixed in 0.6.5
Timeline
- 2026-10-02 Threatist record created from CVE-2025-53941
References
More fedify-dev vulnerabilities
- TI-2026-44926 Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources CVSS 4.0HIGH 8.8
- TI-2025-34622 @fedify/fedify: Improper Authentication and Incorrect Authorization CVSS 4.0HIGH 8.7
- TI-2026-36902 Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges CVSS 3.1HIGH 8.6
- TI-2026-30750 Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring CVSS 3.1HIGH 7.0
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences