CVE-2025-2361

Name	CVE-2025-2361
Description	A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-5883-1
Debian Bugs	1100899

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mercurial (PTS)	bullseye	5.6.1-4	vulnerable
	bookworm	6.3.2-1	vulnerable
	bookworm (security)	6.3.2-1+deb12u1	fixed
	sid, trixie	6.9.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mercurial	source	bookworm	6.3.2-1+deb12u1		DSA-5883-1
mercurial	source	(unstable)	6.9.4-1			1100899

Notes

https://lists.mercurial-scm.org/pipermail/mercurial-packaging/2025-March/000754.html
Fixed by: https://foss.heptapod.net/mercurial/mercurial-devel/-/commit/a5c72ed2929341d97b11968211c880854803f003 (6.9.4)