CVE-2025-65109

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84.

CVSS

No CVSS.

References

Link	Resource
https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8
https://github.com/mindersec/minder/security/advisories/GHSA-6xvf-4vh9-mw47

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Minder es una plataforma de seguridad de la cadena de suministro de software de código abierto. En las versiones de Minder Helm 0.20241106.3386+ref.2507dbf y de Minder Go de 0.0.72 a 0.0.83, los usuarios de Minder pueden obtener contenido en el contexto del servidor de Minder, lo que puede incluir URL a las que el usuario normalmente no tendría acceso. Este problema ha sido parcheado en la versión de Minder Helm 0.20250203.3849+ref.fdc94f0 y en la versión de Minder Go 0.0.84.

Information

Published : 2025-11-21 22:16

Updated : 2026-10-18 20:10

NVD link : CVE-2025-65109

Mitre link : CVE-2025-65109

CVE.ORG link : CVE-2025-65109

JSON object : View

Products Affected

No product.

CWE

CWE-830

Inclusion of Web Functionality from an Untrusted Source

{"id": "CVE-2025-65109", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65109", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-24T17:17:34.507772Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "mindersec", "product": "minder", "versions": [{"status": "affected", "version": "Helm = 0.20241106.3386+ref.2507dbf"}, {"status": "affected", "version": "Go >= 0.0.72, < 0.0.84"}]}]}], "published": "2025-11-21T22:16:33.507", "references": [{"url": "https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8", "source": "security-advisories@github.com"}, {"url": "https://github.com/mindersec/minder/security/advisories/GHSA-6xvf-4vh9-mw47", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-830"}]}], "descriptions": [{"lang": "en", "value": "Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84."}, {"lang": "es", "value": "Minder es una plataforma de seguridad de la cadena de suministro de software de c\u00f3digo abierto. En las versiones de Minder Helm 0.20241106.3386+ref.2507dbf y de Minder Go de 0.0.72 a 0.0.83, los usuarios de Minder pueden obtener contenido en el contexto del servidor de Minder, lo que puede incluir URL a las que el usuario normalmente no tendr\u00eda acceso. Este problema ha sido parcheado en la versi\u00f3n de Minder Helm 0.20250203.3849+ref.fdc94f0 y en la versi\u00f3n de Minder Go 0.0.84."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "security-advisories@github.com"}