CVE-2025-59163
BaseFortify
Publication date: 2025-09-29
Last updated on: 2025-10-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| safedep | vet | 1.12.4 |
| safedep | vet | 1.12.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-350 | The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized remote attackers accessing sensitive data stored in the vet scan sqlite3 database. This exposure occurs when vet is used as an MCP server in SSE mode with default ports, potentially compromising data confidentiality.
What immediate steps should I take to mitigate this vulnerability?
Upgrade vet to version 1.12.5 or later, as this version fixes the DNS rebinding vulnerability by adding HTTP Host and Origin header validation.
Can you explain this vulnerability to me?
This vulnerability affects the vet software (versions 1.12.4 and below) and is due to a DNS rebinding attack caused by the lack of validation of HTTP Host and Origin headers. This flaw allows remote attackers to potentially access data from the vet scan sqlite3 database when vet is used as an MCP server in SSE mode with default ports through the sqlite3 query MCP tool. The issue is resolved in version 1.12.5.