Vulnerability · Published Nov 21, 2025 · Assigned by GitHub_M
CVE-2025-65109Minder does not sandbox http.send in Rego programs
High 8.5
In plain English
A high-severity security flaw in minder from mindersec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/mindersec/minder | 0.0.84 | GHSA-6xvf-4vh9-mw47 |
| Go | github.com/mindersec/minder | 0.0.84 | GO-2025-4147 |
Affected products (as reported)
Weakness: CWE-830 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L