GitHub Advisoryadvisory · Maven

GHSA-v6x2-4q87-rf82 Apache SkyWalking has a stored XSS vulnerability

MEDIUM Published 2025-11-27 Modified 2026-04-14 Official page ↗
Aliases
CVE-2025-54057
Ecosystem
Maven
Packages
org.apache.skywalking:apm-webapp
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-80
Reviewed
2025-12-05

Affected packages

• Maven org.apache.skywalking:apm-webapp: <= 10.1.0 (no fix yet)

Description

There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking. This issue affects Apache SkyWalking versions <= 10.2.0. Users are recommended to upgrade to version 10.3.0, which fixes the issue. Version 10.3.0 has not been uploaded to the Maven registry at time of publish, please see release notes for download instructions.

Related

Alias · CVE (1)

  • CVE-2025-54057 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking. vulnerability

Weakness · CWE (1)

  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References