CVE-2025-50182

Katalog CVE

CVSS 6.1 · Medium EPSS 0,39%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada python urllib3. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.

Rincian

Terbit di NVD

19 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5 advisory vendor
• https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f patch
• https://github.com/urllib3/urllib3/releases/tag/2.5.0