CVE-2025-65109

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-65109", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-11-17T20:55:34.694Z", "datePublished": "2025-11-21T21:56:53.667Z", "dateUpdated": "2025-11-24T17:17:41.932Z"}, "containers": {"cna": {"title": "Minder does not sandbox http.send in Rego programs", "problemTypes": [{"descriptions": [{"cweId": "CWE-830", "lang": "en", "description": "CWE-830: Inclusion of Web Functionality from an Untrusted Source", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "baseScore": 8.5, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/mindersec/minder/security/advisories/GHSA-6xvf-4vh9-mw47", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mindersec/minder/security/advisories/GHSA-6xvf-4vh9-mw47"}, {"name": "https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8", "tags": ["x_refsource_MISC"], "url": "https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8"}], "affected": [{"vendor": "mindersec", "product": "minder", "versions": [{"version": "Helm = 0.20241106.3386+ref.2507dbf", "status": "affected"}, {"version": "Go >= 0.0.72, < 0.0.84", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-21T21:56:53.667Z"}, "descriptions": [{"lang": "en", "value": "Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84."}], "source": {"advisory": "GHSA-6xvf-4vh9-mw47", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-24T17:17:34.507772Z", "id": "CVE-2025-65109", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T17:17:41.932Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-65109", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-24T17:17:34.507772Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T17:17:38.827Z"}}], "cna": {"title": "Minder does not sandbox http.send in Rego programs", "source": {"advisory": "GHSA-6xvf-4vh9-mw47", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "mindersec", "product": "minder", "versions": [{"status": "affected", "version": "Helm = 0.20241106.3386+ref.2507dbf"}, {"status": "affected", "version": "Go >= 0.0.72, < 0.0.84"}]}], "references": [{"url": "https://github.com/mindersec/minder/security/advisories/GHSA-6xvf-4vh9-mw47", "name": "https://github.com/mindersec/minder/security/advisories/GHSA-6xvf-4vh9-mw47", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8", "name": "https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-830", "description": "CWE-830: Inclusion of Web Functionality from an Untrusted Source"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-21T21:56:53.667Z"}}}, "cveMetadata": {"cveId": "CVE-2025-65109", "state": "PUBLISHED", "dateUpdated": "2025-11-24T17:17:41.932Z", "dateReserved": "2025-11-17T20:55:34.694Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-11-21T21:56:53.667Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "minder", "vendor": "mindersec", "versions": [{"status": "affected", "version": "Helm = 0.20241106.3386+ref.2507dbf"}, {"status": "affected", "version": "Go >= 0.0.72, < 0.0.84"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84."}, {"lang": "es", "value": "Minder es una plataforma de seguridad de la cadena de suministro de software de c\u00f3digo abierto. En las versiones de Minder Helm 0.20241106.3386+ref.2507dbf y de Minder Go de 0.0.72 a 0.0.83, los usuarios de Minder pueden obtener contenido en el contexto del servidor de Minder, lo que puede incluir URL a las que el usuario normalmente no tendr\u00eda acceso. Este problema ha sido parcheado en la versi\u00f3n de Minder Helm 0.20250203.3849+ref.fdc94f0 y en la versi\u00f3n de Minder Go 0.0.84."}], "id": "CVE-2025-65109", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65109", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-24T17:17:34.507772Z", "version": "2.0.3"}}]}, "published": "2025-11-21T22:16:33.507", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8"}, {"source": "security-advisories@github.com", "url": "https://github.com/mindersec/minder/security/advisories/GHSA-6xvf-4vh9-mw47"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-830"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-11-24T09:08:27.438057+00:00", "updated": "2025-11-24T09:08:27.438085+00:00", "vendors": ["mindersec", "mindersec$PRODUCT$minder"]}