Skip to content
OpenAdvisories
Medium · 6.1 CVE-2025-53941 EUVD-2025-21766

Hollo renders posts received with form elements and allows submission

Published Jul 17, 2025 · Updated Jul 17, 2025 · Assigned by GitHub_M

Description

Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Versions prior to 0.6.5 allow HTML form elements to be submitted, making the software vulnerable to HTML injection. Version 0.6.5 fixes the issue.

Affected products

VendorProductAffectedFixed
fedify-dev hollo < 0.6.5 —

References