Is CVE-2025-6050 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-6050 being exploited in the wild.

How severe is CVE-2025-6050?

Medium severity, with a CVSS score of 4, published 17 June 2025.

Which products and versions are affected?

Mezzanine (PyPI) < 6.1.1, ECOSYSTEM:introduced=0,fixed=6.1.1.

Is there a fix for CVE-2025-6050?

Yes. Mezzanine (PyPI): upgrade to 6.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-6050 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-6050?

Check whether you run Mezzanine (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-6050: Mezzanine CMS stored XSS in displayable_links_js function

Q: Which products and versions are affected?

Mezzanine (PyPI) < 6.1.1, ECOSYSTEM:introduced=0,fixed=6.1.1.

Q: Is there a fix for CVE-2025-6050?

Yes. Mezzanine (PyPI): upgrade to 6.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-6050 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-6050?

Check whether you run Mezzanine (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-6050 · Severity: medium · CVSS 4 · Published 2025-06-17

Mezzanine CMS, a content management system platform, contains a security flaw in its administrative interface. An attacker with administrative privileges can create a blog post with a malicious title that, when viewed by another administrator, executes unauthorized code in their web browser. This could allow an attacker to perform actions on behalf of other administrators or access sensitive information within the management console.

Technologies: Mezzanine (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-6050 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-6050 being exploited in the wild.
How severe is CVE-2025-6050?: Medium severity, with a CVSS score of 4, published 17 June 2025.
Which products and versions are affected?: Mezzanine (PyPI) < 6.1.1, ECOSYSTEM:introduced=0,fixed=6.1.1.
Is there a fix for CVE-2025-6050?: Yes. Mezzanine (PyPI): upgrade to 6.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-6050 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-6050?: Check whether you run Mezzanine (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Mezzanine (PyPI): upgrade to 6.1.1 or later
```
pip install "Mezzanine>=6.1.1"
```

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Mezzanine CMS versions prior to 6.1.1. The flaw is located in the 'displayable_links_js' function within 'mezzanine/core/views.py', which fails to properly sanitize blog post titles before including them in JSON responses served via the '/admin/displayable_links.js' endpoint. An authenticated attacker with high privileges (admin) can inject a malicious JavaScript payload into a blog post title. If another administrator is tricked into visiting the affected endpoint, the payload executes in their browser context. The issue was addressed in version 6.1.1 by implementing proper escaping of the title field.

Affected products

stephenmcd Mezzanine CMS < 6.1.1

Identifiers

CVE-2025-6050
GHSA-7pr5-w74r-jjj7
PYSEC-2025-236

Timeline

2025-05-21: disclosed: Initial outreach by Checkmarx researchers on GitHub discussions
2025-06-17: advisory: GitHub Advisory and NVD entry published
2025-06-17: patched: Fix released in version 6.1.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.