{"id":"CVE-2025-54289","title":"Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format","summary":"Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-1385"],"vendor":"canonical","product":"lxd","affected":["lxd >= 4.0.0, < 5.21.4","lxd >= 6.1, < 6.5"],"patched":["lxd 6.5"],"published":"2025-10-02","updated":"2026-10-12","sourceUpdated":"2026-10-12T15:10:00.207","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-54289","references":[{"url":"https://github.com/canonical/lxd/security/advisories/GHSA-3g72-chj4-2228","label":"security@ubuntu.com"},{"url":"https://github.com/canonical/lxd/security/advisories/GHSA-3g72-chj4-2228","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54289"},{"url":"https://github.com/canonical/lxd"},{"url":"https://pkg.go.dev/vuln/GO-2025-3999"}],"tags":["nvd","osv","go"],"epss":0.00212,"epssPercentile":0.11427,"aliases":["GHSA-3g72-chj4-2228","GO-2025-3999"],"ecosystem":"go","scores":{"nvd":8.1,"osv":6.8},"ingestedAt":"2026-07-09T18:56:35.477Z","slug":"CVE-2025-54289","body":"## Overview\n\nPrivilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format\n\n## Affected\n\n- `lxd >= 4.0.0, < 5.21.4`\n- `lxd >= 6.1, < 6.5`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `lxd 6.5`\n\n## Package advisory (CVE-2025-54289)\n\nAffected packages:\n\n- `github.com/canonical/lxd >= 4.0, < 5.21.4`\n- `github.com/canonical/lxd >= 6.0, < 6.5`\n- `github.com/canonical/lxd >= 0.0.0-20200331193331-03aab09f5b5c, < 0.0.0-20250827065555-0494f5d47e41`\n\nPatched in:\n\n- `github.com/canonical/lxd 5.21.4`\n- `github.com/canonical/lxd 6.5`\n- `github.com/canonical/lxd 0.0.0-20250827065555-0494f5d47e41`\n\nSource: https://osv.dev/vulnerability/GHSA-3g72-chj4-2228","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":219444,"id":"CVE-2025-54289","ts":1791820552947,"field":"cvss","old":"6.8","new":"8.1"},{"seq":219443,"id":"CVE-2025-54289","ts":1791820552947,"field":"severity","old":"medium","new":"high"}]}