CVE-2023-46950: XSS sidekiq-unique-jobs UI server vulnerability

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-03-01 · updated 2026-06-17
Weakness: CWE-79

Description

Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions.

Affected products

sidekiq/sidekiq: 6.5.8
Rubygems Sidekiq-Unique-Jobs: from 8.0.0 before 8.0.7; before 7.1.33; 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5 (+148) — fixed in 8.0.7, 7.1.33

How to fix

Upgrade to a fixed version: Rubygems Sidekiq-Unique-Jobs 8.0.7, 7.1.33. Check the vendor advisory for mitigations.

References

https://github.com/mhenrixon/sidekiq-unique-jobs/pull/829
https://github.com/mhenrixon/sidekiq-unique-jobs/releases/tag/v8.0.7
https://github.com/mhenrixon/sidekiq-unique-jobs/security/advisories/GHSA-cmh9-rx85-xj38
https://www.mgm-sp.com/cve/sidekiq-unique-jobs-reflected-xss-cve-2023-46950-cve-2023-46951
https://github.com/mhenrixon/sidekiq-unique-jobs/security/advisories/GHSA-cmh9-rx85-xj38
https://link.org
https://www.link.com

Get alerted when CVE-2023-46950 or the next vulnerability affects your stack