CVE-2025-59163lowCWE-350

CVE-2025-59163: low-severity vulnerability in safedep vet

vet MCP Server SSE Transport DNS Rebinding Vulnerability

Published · Updated

Follow this CVE+ Monitor vet+ Monitor github.com/safedep/vet

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.1epss 0.4%
In short

The vet security tool fails to validate HTTP headers when running as a server, allowing attackers on the same network to trick it into exposing scan database information through a DNS rebinding attack.

Technical detail

CVE-2025-59163 is a DNS rebinding vulnerability (CWE-350) in vet's MCP Server SSE transport layer affecting versions ≤1.12.4. The vulnerability stems from missing Host and Origin header validation; an attacker can rebind a domain to localhost and access the sqlite3 query MCP tool to exfiltrate scan database contents. Requires network access and default port configuration; fixed in v1.12.5.

Summary generated and translated by AI from the official description.
vet is an open source software supply chain security tool. Versions 1.12.4 and below are vulnerable to a DNS rebinding attack due to lack of HTTP Host and Origin header validation. Data from the vet scan sqlite3 database may be exposed to remote attackers when vet is used as an MCP server in SSE mode with default ports through the sqlite3 query MCP tool. This issue is fixed in version 1.12.5.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
safedep · vet