IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-09-29 22:15

MODIFIED

2025-10-02 19:12

EPSS (Prob. Exploit)

0.41%

Top 64.8%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-10-28 OSV 🔗 2026-11-08

> DESCRIPTION

vet is an open source software supply chain security tool. Versions 1.12.4 and below are vulnerable to a DNS rebinding attack due to lack of HTTP Host and Origin header validation. Data from the vet scan sqlite3 database may be exposed to remote attackers when vet is used as an MCP server in SSE mode with default ports through the sqlite3 query MCP tool. This issue is fixed in version 1.12.5.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-6q9c-m9fr-865m LOW

vet MCP Server SSE Transport DNS Rebinding Vulnerability

AFFECTED PACKAGES:

GO / github.com/safedep/vet

< 1.12.5

Fixed in: 1.12.5

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

vet MCP Server SSE Transport DNS Rebinding Vulnerability

AFFECTED PACKAGES:

Unknown / Unknown

65 versions affected

ALIASES:

GHSA-6q9c-m9fr-865m, GO-2025-3986

> HISTORIQUE DES MODIFICATIONS

Première apparition

29/09/2025 22:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:08

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui