CVE-2025-59163 LOW

CVE-2025-59163: vet MCP Server SSE Transport DNS Rebinding Vulnerability

Vendor Safedep
Product vet
Weakness CWE-350
Published September 29, 2025
Last update September 30, 2025
View on NVD All CVEs

CVSS base score

2.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

vet is an open source software supply chain security tool. Versions 1.12.4 and below are vulnerable to a DNS rebinding attack due to lack of HTTP Host and Origin header validation. Data from the vet scan sqlite3 database may be exposed to remote attackers when vet is used as an MCP server in SSE mode with default ports through the sqlite3 query MCP tool. This issue is fixed in version 1.12.5.

Key dates

02Disclosure timeline

September 29, 2025 CVE published
September 30, 2025 Record updated