CVE-2025-53693 HTML Cache Poisoning through Unsafe Reflections

Critical 9.8 Published 3 Sep 2025 Updated 3 Sep 2025

Attackers can exploit unsafe reflection to poison HTML caches, potentially leading to code execution or data modification in Sitecore XM and XP.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-53693?

CVE-2025-53693 is a critical code injection vulnerability in Sitecore Experience Platform (XP), published on 3 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.

Weakness: CWE-470

Which versions are affected by CVE-2025-53693?

It affects 4 products.

Products include Sitecore Experience Commerce, Sitecore Experience Manager, Sitecore Experience Platform, Sitecore Managed Cloud.

How do I fix CVE-2025-53693?

No fix has been published for CVE-2025-53693 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-53693 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53693 exists.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-6jj2-mfwj-34q5.