HTML Injection Vulnerability in Hollo Microblogging Software
CVE-2025-53941

6.1MEDIUM

Key Information:

Vendor

Fedify-dev

Status
Hollo
Vendor
CVE Published:
17 July 2025

What is CVE-2025-53941?

Hollo, a federated single-user microblogging software that operates through ActivityPub, has a vulnerability where versions prior to 0.6.5 permit the submission of HTML form elements, making it susceptible to HTML injection attacks. This flaw could allow attackers to inject malicious HTML content, potentially compromising the security of user interactions. The issue has been addressed in version 0.6.5, which contains necessary patches to close this security gap.

Affected Version(s)

hollo < 0.6.5

References

https://github.com/fedify-dev/hollo/security/advisories/G...
x_refsource_CONFIRM
https://github.com/fedify-dev/hollo/commit/f9d25e10ba5406...
x_refsource_MISC
https://github.com/fedify-dev/hollo/releases/tag/0.6.5
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-53941 : HTML Injection Vulnerability in Hollo Microblogging Software