{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/actiontech/sqle","cve_ids":["CVE-2025-15107"],"ecosystem":"Go","epss":0.00618,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-43h9-hc38-qph5","id":"tcs_01M5KGCSENSSTTQAHRK83A913Z","modified_at":"2026-03-03T04:57:49.397321Z","published_at":"2026-01-12T17:39:39Z","references":["https://osv.dev/vulnerability/GO-2025-4269","https://github.com/advisories/GHSA-43h9-hc38-qph5","https://nvd.nist.gov/vuln/detail/CVE-2025-15107","https://github.com/actiontech/sqle/issues/3186","https://github.com/actiontech/sqle/blob/4714f83f33e0d7aa647036eb756e928aa4174014/sqle/utils/jwt.go#L9","https://github.com/actiontech/sqle/milestone/53","https://vuldb.com/?ctiid.338478","https://vuldb.com/?id.338478","https://vuldb.com/?submit.710380"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GO-2025-4269","url":"https://osv.dev/vulnerability/GO-2025-4269"},{"source":"nvd","source_id":"CVE-2025-15107","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15107"}],"summary":"SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key in github.com/actiontech/sqle"}