CVE-2025-13803: MediaCrush Header paths.py http headers for scripting syntax

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-01 · updated 2026-10-18
Weakness: CWE-644

Description

A vulnerability was identified in MediaCrush 1.0.0/1.0.1. The affected element is an unknown function of the file /mediacrush/paths.py of the component Header Handler. Such manipulation of the argument Host leads to improper neutralization of http headers for scripting syntax. The attack can be launched remotely.

Affected products

MediaCrush: 1.0.0, 1.0.1

References

https://github.com/lakshayyverma/CVE-Discovery/blob/main/mediacrush.md
https://vuldb.com/?ctiid.333813
https://vuldb.com/?id.333813
https://vuldb.com/?submit.691857

Get alerted when CVE-2025-13803 or the next vulnerability affects your stack