{"action":"Upgrade github.com/coder/agentapi to 0.4.0 or later.","affected":[{"fixed":"0.4.0","introduced":"0"}],"component":"github.com/coder/agentapi","cve_ids":["CVE-2025-59956"],"ecosystem":"Go","epss":0.00426,"exploited":false,"fixed_versions":["0.4.0"],"ghsa_id":"GHSA-w64r-2g3w-w8w4","id":"tcs_01M5KFQ8S04TSD3RXNYY4J4SD5","modified_at":"2025-10-23T20:33:23Z","published_at":"2025-09-29T20:40:26Z","references":["https://osv.dev/vulnerability/GHSA-w64r-2g3w-w8w4","https://github.com/coder/agentapi/security/advisories/GHSA-w64r-2g3w-w8w4","https://nvd.nist.gov/vuln/detail/CVE-2025-59956","https://github.com/coder/agentapi/pull/49","https://github.com/coder/agentapi/commit/5c425c62447b8a9eac19e9fc5a2eae7f0803f149","https://github.blog/security/application-security/localhost-dangers-cors-and-dns-rebinding","https://github.com/coder/agentapi","https://github.com/coder/agentapi/releases/tag/v0.4.0","https://mcpsec.dev/advisories/2025-09-19-coder-chat-exfiltration","https://pkg.go.dev/vuln/GO-2025-3991"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-w64r-2g3w-w8w4","url":"https://osv.dev/vulnerability/GHSA-w64r-2g3w-w8w4"}],"summary":"Coder AgentAPI exposed user chat history via a DNS rebinding attack"}