Go/github.com/actiontech/sqle CVE-2025-15107: high 8.1, EPSS 0.62%
SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key in github.com/actiontech/sqle
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GO-2025-4269
- nvd: CVE-2025-15107
- https://github.com/advisories/GHSA-43h9-hc38-qph5
- https://github.com/actiontech/sqle/issues/3186
- https://github.com/actiontech/sqle/blob/4714f83f33e0d7aa647036eb756e928aa4174014/sqle/utils/jwt.go#L9
- https://github.com/actiontech/sqle/milestone/53
- https://vuldb.com/?ctiid.338478
- https://vuldb.com/?id.338478
- https://vuldb.com/?submit.710380
CVE-2025-15107 · published · modified · JSON