Caido Improperly Handles External Links in Markdown
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Caido is a web security auditing toolkit. Prior to version 0.53.0, the Markdown renderer used in Caido’s Findings page improperly handled user-supplied Markdown, allowing attacker-controlled links to be rendered without confirmation. When a user opened a finding generated through the scanner, or other plugins, clicking these injected links could redirect the Caido application to an attacker-controlled domain, enabling phishing style attacks. This issue has been patched in version 0.53.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA caido (caido) Fixed in 0.53.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-66025
More caido vulnerabilities
- TI-2026-20052 Caido has an insufficient patch for DNS rebind leading to RCE CVSS 3.1CRITICAL 9.8
- TI-2025-31132 Hijacking Caido instance during the initial setup via DNS Rebinding to achieve RCE CVSS 3.1HIGH 7.5
- TI-2025-33726 Caido Toast Vulnerable to Reflected Cross-site Scripting CVSS 3.1MEDIUM 6.3
- TI-2025-16849 Cross Site Scripting on URL decode Tooltip in Caido CVSS 3.1MEDIUM 5.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences