CVE-2025-54057

moderate-risk

Published 2025-11-27

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking. This issue affects Apache SkyWalking: <= 10.2.0. Users are recommended to upgrade to version 10.3.0, which fixes the issue.

Do I need to act?

0.45% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.1/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Skywalking

Affected Vendors

Apache

References (3)

Vendor Advisory https://lists.apache.org/thread/sl2x2tx8y007x0mo746yddx2lvnv9tcr

Mailing List http://www.openwall.com/lists/oss-security/2025/11/27/1

http://www.openwall.com/lists/oss-security/2026/04/13/3

/ 100

moderate-risk

Severity 23/34 · High

Exploitability 2/34 · Minimal

Exposure 5/34 · Minimal