Go/github.com/actiontech/sqle CVE-2025-15107: low 3.7, EPSS 0.62%
SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 4.2511.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-43h9-hc38-qph5
- https://nvd.nist.gov/vuln/detail/CVE-2025-15107
- https://github.com/actiontech/sqle/issues/3186
- https://github.com/actiontech/sqle
- https://github.com/actiontech/sqle/blob/4714f83f33e0d7aa647036eb756e928aa4174014/sqle/utils/jwt.go#L9
- https://github.com/actiontech/sqle/milestone/53
- https://vuldb.com/?ctiid.338478
- https://vuldb.com/?id.338478
- https://vuldb.com/?submit.710380
CVE-2025-15107 · published · modified · JSON