ID |
CVE-2025-53637
|
Sažetak |
Meshtastic is an open source mesh networking solution. The main_matrix.yml GitHub Action is triggered by the pull_request_target event, which has extensive permissions, and can be initiated by an attacker who forked the repository and created a pull request. In the shell code execution part, user-controlled input is interpolated unsafely into the code. If this were to be exploited, attackers could inject unauthorized code into the repository. This vulnerability is fixed in 2.6.6. |
Reference |
|
CVSS |
Base: | 4.1 |
Impact: | 1.4 |
Exploitability: | 2.3 |
|
Pristup |
Vektor | Složenost | Autentikacija |
NETWORK |
LOW |
LOW |
|
Impact |
Povjerljivost | Cjelovitost | Dostupnost |
LOW |
NONE |
NONE |
|
CVSS vektor |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N |
Zadnje važnije ažuriranje |
10-07-2025 - 22:15 |
Objavljeno |
10-07-2025 - 22:15 |