{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.12.0"}],"component":"yapi-vendor","cve_ids":["CVE-2025-70058"],"ecosystem":"npm","epss":0.0019,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-663h-2vr3-ghrj","id":"tcs_01M5KF5WDJ8CD5W1DHVJAKZ1BQ","modified_at":"2026-02-25T23:11:20.486954Z","published_at":"2026-02-23T18:32:02Z","references":["https://osv.dev/vulnerability/GHSA-663h-2vr3-ghrj","https://nvd.nist.gov/vuln/detail/CVE-2025-70058","https://gist.github.com/zcxlighthouse/11c53803faf23f607c2787c166e811d4","https://github.com/YMFE","https://github.com/YMFE/yapi","https://github.com/YMFE/yapi/blob/59bade3a8a43e7db077d38a4b0c7c584f30ddf8c/common/postmanLib.js#L110"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-663h-2vr3-ghrj","url":"https://osv.dev/vulnerability/GHSA-663h-2vr3-ghrj"}],"summary":"yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent"}