CVE-2025-53639 Metersphere has SQL Injection Vulnerability in Sorting Field

What is CVE-2025-53639?

CVE-2025-53639 is a medium-severity SQL injection vulnerability in metersphere, published on 14 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

MeterSphere is an open source continuous testing platform. Prior to version 3.6.5-lts, the sortField parameter in certain API endpoints is not properly validated or sanitized. An attacker can supply crafted input to inject and execute arbitrary SQL statements through the sorting functionality. This could result in modification or deletion of database contents, with a potential full compromise of the application’s database integrity and availability. Version 3.6.5-lts fixes the issue.

Weakness: CWE-89

Which versions are affected by CVE-2025-53639?

It affects 1 product.

Products include Metersphere Metersphere.

How do I fix CVE-2025-53639?

No fix has been published for CVE-2025-53639 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2025-53639 being exploited?

There is no known exploitation of CVE-2025-53639 in the wild and no public exploit code.

Other vulnerabilities in metersphere

• CVE-2023-29944 Command injection in n/a Critical 9.8
• CVE-2021-45790 File upload in n/a Critical 9.8
• CVE-2021-45788 SQL injection in n/a High 8.8
• CVE-2023-25573 Improper access control to download file in metersphere High 8.6
• CVE-2022-23512 Metersphere is vulnerable to Path Injection. High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vcm3-5w3f-9f45.