Vulnerability · Published Aug 5, 2025 · Assigned by GitHub_M

CVE-2025-54872onion-site-template tor Secrets Baked Into Image

High 8.7

In plain English

A high-severity hard-coded credentials in onion-site-template from Vessel9817. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 66.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

onion-site-template is a complete, scalable tor hidden service self-hosting sample. Versions which include commit 3196bd89 contain a baked-in tor image if the secrets were copied from an existing onion domain. A website could be compromised if a user shared the baked-in image, or if someone were able to acquire access to the user's device outside of a containerized environment. This is fixed by commit bc9ba0fd.

Affected products (as reported)

Vendor	Product	Versions
Vessel9817	onion-site-template	>= 3196bd896fed58306d42cc9f4c1e0760e8c829c9, < bc9ba0fd8cc7fbb3abc6759b351885a4501bce84

Weakness: CWE-798 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

References

https://github.com/Vessel9817/onion-site-template/security/advisories/GHSA-mj8m-c8w9-rw55 x_refsource_CONFIRM
https://github.com/Vessel9817/onion-site-template/commit/bc9ba0fd8cc7fbb3abc6759b351885a4501bce84 x_refsource_MISC