CVE-2025-54414 Anubis accepts crafted redirect URLs in pass-challenge 'Try Again' buttons
Attackers can craft malicious redirect URLs in Anubis pass-challenge pages to execute arbitrary JavaScript or trigger nonstandard schemes in user browsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-54414?
CVE-2025-54414 is a medium-severity cross-site scripting vulnerability in TecharoHQ anubis, published on 26 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Anubis is a Web AI Firewall Utility that weighs the soul of users' connections using one or more challenges in order to protect upstream resources from scraper bots. In versions 1.21.2 and below, attackers can craft malicious pass-challenge pages that cause a user to execute arbitrary JavaScript code or trigger other nonstandard schemes. An incomplete version of this fix was tagged at 1.21.2 and then the release process was aborted upon final testing. To work around this issue: block any requests to the /.within.website/x/cmd/anubis/api/pass-challenge route with the ?redir= parameter set to anything that doesn't start with the URL scheme http, https, or no scheme (local path redirect). This was fixed in version 1.21.3.
Which versions are affected by CVE-2025-54414?
How do I fix CVE-2025-54414?
No fix has been published for CVE-2025-54414 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-54414 being exploited?
There is no known exploitation of CVE-2025-54414 in the wild and no public exploit code.
Sources
Also known as GHSA-jhjj-2g64-px7c.