CVE-2025-50182

Aliases:GHSA-48p4-8xcf-vxj5
Advisory lineage Upstream: 0 Downstream: 4
Modified
Published: 19 Jun 2025, 01:42
Last modified:22 Dec 2025, 18:43

Vulnerability Summary

Overall Risk (default)
low
24/100
CVSS Score
6.1 MEDIUM
v3.1 (nvd)
EPSS Score
0.07% LOW
0% probability +0.05%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

19 Jun 2025, 01:42
Published
Vulnerability first disclosed
22 Dec 2025, 18:43
Last Modified
Vulnerability information updated

Description

urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
  • v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.07%• Percentile: 21%

Techniques & Countermeasures

  • CWE-601•URL Redirection to Untrusted Site ('Open Redirect')

    The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Affected Systems

  • PyPI•urllib3

    ≥ 2.2.0, < 2.5.0

  • python•urllib3

    ≥ 2.2.0, < 2.5.0

  • urllib3•urllib3

    ≥ 2.2.0, < 2.5.0

References (5)