What’s Vulnerable › Vulnerabilities

CVE-2025-53941: Hollo renders posts received with form elements and allows submission

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-17 · updated 2026-06-17
• Weakness: CWE-79

Description

Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Versions prior to 0.6.5 allow HTML form elements to be submitted, making the software vulnerable to HTML injection. Version 0.6.5 fixes the issue.

Affected products

• fedify-dev hollo: before 0.6.5

References

• https://github.com/fedify-dev/hollo/commit/f9d25e10ba5406c27f9e87dfb01f75b6a52f2410
• https://github.com/fedify-dev/hollo/releases/tag/0.6.5
• https://github.com/fedify-dev/hollo/security/advisories/GHSA-w7gc-g3x7-hq8h
• https://github.com/fedify-dev/hollo/security/advisories/GHSA-w7gc-g3x7-hq8h

Get alerted when CVE-2025-53941 or the next vulnerability affects your stack