CVE-2025-67202 identifies a cross-site scripting (CWE-79) vulnerability in Sidekiq-cron, an open-source scheduling add-on for Sidekiq, affecting versions through 2.3.1. The vulnerability arises from the rendering of crafted URLs in the cron.erb template, which can lead to script injection. The CVSS 3.1 base score is 6.1, reflecting a network attack vector with low attack complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity but no impact on availability. No official patch or remediation level has been published by the vendor as of the data provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to information disclosure or manipulation of data accessible to the user. However, there is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when handling untrusted URLs in Sidekiq-cron interfaces and consider applying temporary mitigations such as input validation or output encoding if feasible.