Skip to content

Commit 32bb37f

Browse files
1 parent c01eec7 commit 32bb37f

File tree

2 files changed

+50
-10
lines changed

2 files changed

+50
-10
lines changed

advisories/unreviewed/2025/10/GHSA-97w9-v595-3h5q/GHSA-97w9-v595-3h5q.json renamed to advisories/github-reviewed/2025/10/GHSA-97w9-v595-3h5q/GHSA-97w9-v595-3h5q.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-97w9-v595-3h5q",
4-
"modified": "2025-10-31T09:30:25Z",
4+
"modified": "2025-10-31T17:56:11Z",
55
"published": "2025-10-31T09:30:25Z",
66
"aliases": [
77
"CVE-2025-63675"
88
],
9+
"summary": "cryptidy allows code execution via untrusted data due to pickle.loads ",
910
"details": "cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "cryptidy"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "1.2.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -23,6 +44,10 @@
2344
"type": "WEB",
2445
"url": "https://github.com/javiermorales36/cryptidy-analysis"
2546
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/netinvent/cryptidy"
50+
},
2651
{
2752
"type": "WEB",
2853
"url": "https://github.com/netinvent/cryptidy/blob/cebc9ffd54cc20679d15a1a43ca9a5da645b0c58/cryptidy/symmetric_encryption.py#L220-L238"
@@ -33,8 +58,8 @@
3358
"CWE-502"
3459
],
3560
"severity": "MODERATE",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-10-31T17:56:11Z",
3863
"nvd_published_at": "2025-10-31T07:15:38Z"
3964
}
4065
}

advisories/unreviewed/2025/10/GHSA-f9f4-5859-29mf/GHSA-f9f4-5859-29mf.json renamed to advisories/github-reviewed/2025/10/GHSA-f9f4-5859-29mf/GHSA-f9f4-5859-29mf.json

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,45 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-f9f4-5859-29mf",
4-
"modified": "2025-10-30T21:30:46Z",
4+
"modified": "2025-10-31T17:55:40Z",
55
"published": "2025-10-30T21:30:46Z",
66
"aliases": [
77
"CVE-2025-61141"
88
],
9-
"details": "sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands.",
9+
"summary": "sqls-server/sqls is vulnerable to command injection in the config command ",
10+
"details": "sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands.\n\nThis issue has been patched via commit https://github.com/sqls-server/sqls/commit/468a23fc89af89f632cc023a10c031e4bc781797.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/sqls-server/sqls"
22+
},
23+
"versions": [
24+
"0.2.28"
25+
]
26+
}
27+
],
1728
"references": [
1829
{
1930
"type": "ADVISORY",
2031
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61141"
2132
},
2233
{
2334
"type": "WEB",
24-
"url": "https://advisory.dw1.io/54"
35+
"url": "https://github.com/sqls-server/sqls/commit/468a23fc89af89f632cc023a10c031e4bc781797"
2536
},
2637
{
2738
"type": "WEB",
39+
"url": "https://advisory.dw1.io/54"
40+
},
41+
{
42+
"type": "PACKAGE",
2843
"url": "https://github.com/sqls-server/sqls"
2944
},
3045
{
@@ -37,8 +52,8 @@
3752
"CWE-77"
3853
],
3954
"severity": "HIGH",
40-
"github_reviewed": false,
41-
"github_reviewed_at": null,
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2025-10-31T17:55:40Z",
4257
"nvd_published_at": "2025-10-30T20:15:39Z"
4358
}
4459
}

0 commit comments

Comments
 (0)