Home

Description

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84.

PUBLISHED Reserved 2025-11-17 | Published 2025-11-21 | Updated 2025-11-24 | Assigner GitHub_M




HIGH: 8.5CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L

Problem types

CWE-830: Inclusion of Web Functionality from an Untrusted Source

Product status

Helm = 0.20241106.3386+ref.2507dbf
affected

Go >= 0.0.72, < 0.0.84
affected

References

github.com/...minder/security/advisories/GHSA-6xvf-4vh9-mw47

github.com/...ommit/f770400923984649a287d7215410ef108e845af8

cve.org (CVE-2025-65109)

nvd.nist.gov (CVE-2025-65109)

Download JSON