CVE-2025-55300CWE-79

Komari Allows Cross-site WebSocket Hijacking

High · published August 18, 2025

CVSS v4.0
8.6
EPSS
1%
Percentile
45.4
In the wild
Unconfirmed
What it is

Komari is a lightweight, self-hosted server monitoring tool designed to provide a simple and efficient solution for monitoring server performance. Prior to 1.0.4-fix1, WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking (CSWSH) attacks against authenticated users. Any third party website can send requests to the terminal websocket endpoint with browser's cookies, resulting in remote code execution. This vulnerability is fixed in 1.0.4-fix1.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00553 · 45.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-08-18T17:41Z
EPSS history
Timeline
  • 18 AUG 17:41Z
    Komari Allows Cross-site WebSocket Hijacking
    cvelistv5