What is CVE-2025-53639?

CVE-2025-53639 is a critical-severity vulnerability in Metersphere, classified under SQL Injection. CVSS score: 9.8/10. Published 2025-07-14.

How severe is CVE-2025-53639?

Critical severity. CVSS v3 base score is 9.8 out of 10.

SQL Injection in Metersphere

CVE-2025-53639

MeterSphere is an open source continuous testing platform. Prior to version 3.6.5-lts, the sortField parameter in certain API endpoints is not properly validated or sanitized. An attacker can supply crafted input to inject and execute arbitrary SQL statements through the sorting functionality. This could result in modification or deletion of database contents, with a potential full compromise of the application’s database integrity and availability. Version 3.6.5-lts fixes the issue.

Vulnerability class: SQL Injection

EPSS: 0.004 (28.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Metersphere — versions < 3.6.5-lts

Weakness classification (CWE)

CWE-89 — SQL Injection

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2025-53639?: CVE-2025-53639 is a critical-severity vulnerability in Metersphere, classified under SQL Injection. CVSS score: 9.8/10. Published 2025-07-14.
How severe is CVE-2025-53639?: Critical severity. CVSS v3 base score is 9.8 out of 10.