{"id":"CVE-2025-54289","aliases":["GHSA-3g72-chj4-2228","GO-2025-3999"],"url":"https://o3.security/vulnerability/CVE-2025-54289","summary":"Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API","details":"Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format","published":"2025-10-02T09:23:03.238Z","modified":"2026-08-08T03:47:55.306313644Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/canonical/lxd","fixedVersion":"5.21.4"},{"ecosystem":"Go","name":"github.com/canonical/lxd","fixedVersion":"6.5"},{"ecosystem":"Go","name":"github.com/canonical/lxd","fixedVersion":"0.0.0-20250827065555-0494f5d47e41"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54289.json"},{"type":"ADVISORY","url":"https://github.com/canonical/lxd/security/advisories/GHSA-3g72-chj4-2228"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54289"},{"type":"PACKAGE","url":"https://github.com/canonical/lxd"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-08T03:47:55.306313644Z"}}