GitHub Advisoryadvisory · Go

GHSA-fr62-mg2q-7wqv In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim

MEDIUM Published 2025-03-04 Modified 2025-03-11 Official page ↗
Aliases
CVE-2025-27155
Ecosystem
Go
Packages
github.com/matrix-org/pinecone
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79, CWE-80
Reviewed
2025-03-04

Affected packages

• Go github.com/matrix-org/pinecone: <= 0.11.0 (no fix yet)

Description

Impact The Pinecone Simulator (pineconesim) included in Pinecone up to commit https://github.com/matrix-org/pinecone/commit/ea4c33717fd74ef7d6f49490625a0fa10e3f5bbc is vulnerable to stored cross-site scripting. The payload storage is not permanent and will be wiped when restarting pineconsim. Patches Commit https://github.com/matrix-org/pinecone/commit/218b2801995b174085cb1c8fafe2d3aa661f85bd contains the fixes. Workarounds N/A For more information If you have any questions or comments about this advisory, please email us at security at matrix.org.

Related

Alias · CVE (1)

  • CVE-2025-27155 Pinecone is an experimental overlay routing protocol suite which is the foundation of the current P2P Matrix demos. vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References