CVE-2025-45286

MediumCVSS 6.1

Published: 02/01/2026(UTC)Updated: 04/11/2026(UTC)Translated: 04/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

Risk Assessment

This vulnerability could allow execution of malicious JavaScript in a user's browser, risking session theft or data exposure. Organizations using httpbin in production are exposed to XSS attacks.

Recommendation

Update httpbin to a patched version or implement proper input filtering and encoding. Avoid exposing httpbin publicly without additional protections.

Other vulnerabilities in httpbin

CVE-2025-15095Low
postmanlabs httpbin up to 0.6.1 has a cross-site scripting (XSS) vulnerability in the file httpbin-master/httpbin/core.py. The attack can be initiated remotely and the exploit has been publicly disclosed. The project has not responded.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in mccutchen httpbin v2.17.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS