VDB
CVE-2025-27155
CVE-2025-27155
PUBLISHED
CVSS 6.1 MEDIUM
In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim
Reported by github_m · Published March 4, 2025
Pinecone is an experimental overlay routing protocol suite which is the foundation of the current P2P Matrix demos. The Pinecone Simulator (pineconesim) included in Pinecone up to commit ea4c337 is vulnerable to stored cross-site scripting. The payload storage is not permanent and will be wiped when restarting pineconesim.
Risk scores
CVSS 3.1
6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| matrix-org | pinecone | < 218b2801995b174085cb1c8fafe2d3aa661f85bd |
| matrix-org | pinecone | 0 |
| github.com | matrix-org/pinecone | 0 |
Timeline
- Mar 4, 2025 CVE Published
- Mar 4, 2025 Coalition ESS Score (9 in total, the first dated here)
- Mar 4, 2025 CVE Updated
- Mar 5, 2025 EPSS Score (30 in total, the first dated here)
- Dec 19, 2025 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-27155
vulnetix vdb fixes CVE-2025-27155Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-27155/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/matrix-org/pinecone/security/advisories/GHSA-fr62-mg2q-7wqv x_refsource_CONFIRM
- https://github.com/matrix-org/pinecone/commit/218b2801995b174085cb1c8fafe2d3aa661f85bd x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2025-27155 advisory
- https://github.com/advisories/GHSA-fr62-mg2q-7wqv advisory
- https://github.com/matrix-org/pinecone url
- https://pkg.go.dev/vuln/GO-2025-3500 url