CVE catalog

CVE-2020-25789

tt-rss: CVE-2020-25789

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.88% · Oct 25, 2026

An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. The cached_url feature mishandles JavaScript inside an SVG document.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantt-rsssid21~git20210204.b4cbc79+dfsg-2fixed
Debiantt-rssbookworm21~git20210204.b4cbc79+dfsg-1.2fixed
Ubuntutt-rss16.041.15+dfsg-1vulnerable
Ubuntutt-rss16.0415.7+git20151123+dfsg-1vulnerable
Ubuntutt-rss16.0415.7+git20151123+dfsg-1ubuntu1vulnerable
Ubuntutt-rss18.0417.1+git20170410+dfsg-2vulnerable
Ubuntutt-rss18.0417.1+git20170410+dfsg-2ubuntu1vulnerable
Ubuntutt-rss22.0421~git20210204.b4cbc79+dfsg-1vulnerable
Ubuntutt-rss24.0421~git20210204.b4cbc79+dfsg-1.2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantt-rsssourcesid21~git20210204.b4cbc79+dfsg-1not yet assignedNot reported[970633]
Debiantt-rsssourcebookworm21~git20210204.b4cbc79+dfsg-1not yet assignedNot reported[970633]

[Debian bug #970633]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [tt-rss]Fixed
    Details (2)

    • 21~git20210204.b4cbc79+dfsg-1.2 · all · bookworm

      Fixed · Fixed: 21~git20210204.b4cbc79+dfsg-1

      dsa · tt-rss · debian · bookworm; dsa · tt-rss · debian · 12

    • 21~git20210204.b4cbc79+dfsg-1.2 · all · bookworm

      Fixed · Fixed: 21~git20210204.b4cbc79+dfsg-1

      dsa · tt-rss · debian · bookworm; dsa · tt-rss · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]