Junglewise Threat Intelligence

CVE-2025-67202: Sidekiq-cron reflected XSS in web UI via crafted URL

CVE-2025-67202 · Severity: medium · CVSS 6.1 · Published 2026-05-07

Vendors: RubyGems.

Executive brief

Sidekiq-cron is a scheduling tool used with Sidekiq to manage recurring background tasks in Ruby applications. A security flaw in its web management interface allows attackers to execute malicious scripts in the browser of an authorized user who clicks a specially crafted link. This could lead to the theft of sensitive session data, cookies, or unauthorized actions performed on behalf of the administrator.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in Sidekiq-cron versions prior to 2.4.0. The root cause is the improper neutralization of user-controllable input, specifically the 'namespace' variable and other GET parameters, before they are rendered in the 'cron.erb' view of the admin web UI. An attacker can exploit this by tricking an authenticated user into clicking a crafted URL containing a malicious payload (e.g., within the /sidekiq/cron/namespaces/ path). Successful exploitation allows for arbitrary JavaScript execution in the context of the victim's session, potentially leading to session hijacking or data exfiltration. The issue is mitigated in environments using Sidekiq 7.3.0+ with strict Content Security Policies (CSP), but remains a vulnerability at the application level. The fix, introduced in version 2.4.0, involves proper URL encoding and escaping of these variables using CGI.escape.

Affected products

  • sidekiq-cron sidekiq-cron < 2.4.0

Timeline

  • 2025-12-01: disclosed: Issue reported and PR opened on GitHub
  • 2026-05-06: patched: Version 2.4.0 released
  • 2026-05-07: advisory: GitHub and NVD advisories published

References