> CVE-2025-54289

« BACK_TO_HOME
PUBLISHED
2025-10-02 10:15
MODIFIED
2025-10-03 14:15
EPSS (Prob. Exploit)
0.21%
Top 88.4%
DATA SOURCES:
NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-3g72-chj4-2228 HIGH

Canonical LXD Vulnerable to Privilege Escalation via WebSocket Connection Hijacking in Operations API

AFFECTED PACKAGES:
GO / github.com/canonical/lxd
>= 0.0.0-20200331193331-03aab09f5b5c, < 0.0.0-20250827065555-0494f5d47e41
Fixed in: 0.0.0-20250827065555-0494f5d47e41
GO / github.com/canonical/lxd
>= 6.0, < 6.5
Fixed in: 6.5
GO / github.com/canonical/lxd
>= 4.0, < 5.21.4
Fixed in: 5.21.4

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API

AFFECTED PACKAGES:
Unknown / Unknown
43 versions affected
ALIASES:
GHSA-3g72-chj4-2228, GO-2025-3999

> HISTORIQUE DES MODIFICATIONS

Première apparition
02/10/2025 10:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:08
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 1 year ago
« BACK_TO_HOME