{"action":"Upgrade sidekiq-cron to 2.4.0 or later.","affected":[{"fixed":"2.4.0","introduced":"0"}],"component":"sidekiq-cron","cve_ids":["CVE-2025-67202"],"ecosystem":"RubyGems","epss":0.00194,"exploited":false,"fixed_versions":["2.4.0"],"ghsa_id":"GHSA-xv9c-mjw8-79gf","id":"tcs_01M5KEPBD31EM4CR0Q5J0EPX0D","modified_at":"2026-05-29T22:00:14.621971136Z","published_at":"2026-05-07T15:38:41Z","references":["https://osv.dev/vulnerability/GHSA-xv9c-mjw8-79gf","https://nvd.nist.gov/vuln/detail/CVE-2025-67202","https://github.com/sidekiq-cron/sidekiq-cron/issues/569","https://github.com/sidekiq-cron/sidekiq-cron/pull/568","https://github.com/sidekiq-cron/sidekiq-cron/commit/7b4ae4822f93ef4646f5cb55500ca4e25662db7c","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sidekiq-cron/CVE-2025-67202.yml","https://github.com/sidekiq-cron/sidekiq-cron","https://github.com/sidekiq-cron/sidekiq-cron/releases/tag/v2.4.0"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-xv9c-mjw8-79gf","url":"https://osv.dev/vulnerability/GHSA-xv9c-mjw8-79gf"}],"summary":"Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL"}