CVE-2025-70058
1 advisory.
npm/yapi-vendor CVE-2025-70058: high 7.4, EPSS 0.19%
yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.12.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-663h-2vr3-ghrj
- https://nvd.nist.gov/vuln/detail/CVE-2025-70058
- https://gist.github.com/zcxlighthouse/11c53803faf23f607c2787c166e811d4
- https://github.com/YMFE
- https://github.com/YMFE/yapi
- https://github.com/YMFE/yapi/blob/59bade3a8a43e7db077d38a4b0c7c584f30ddf8c/common/postmanLib.js#L110
CVE-2025-70058 · published · modified · JSON