{"answers":{"affected":"3 open source packages ship an affected version, including github.com/google/osv-scalibr.","exploited":"There is no known exploitation of CVE-2025-13425 in the wild and no public exploit code.","fix":"Upgrade github.com/google/osv-scalibr to 0.3.4 or later.","what":"CVE-2025-13425 is a low-severity vulnerability in Google OSV-SCALIBR, published on 20 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-13425 and fix it if it is affected.\n\nWhat it is: CVE-2025-13425 is a low-severity vulnerability in Google OSV-SCALIBR, published on 20 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-13425 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/google/osv-scalibr (Go): affected all versions; fixed in 0.3.4\n- github.com/google/osv-scalibr (Go): affected all versions; fixed in 0.3.4\n- github.com/google/osv-scalibr (Go): affected all versions; fixed in 0.3.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-13425/ (Markdown: https://insights.sbomify.com/CVE-2025-13425/index.md)","id":"CVE-2025-13425","markdown":"https://insights.sbomify.com/CVE-2025-13425/index.md","name":"CVE-2025-13425","record":{"aliases":["GHSA-f786-75f3-74xj","GO-2025-4149"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Go vulnerability scanner","requires_auth":"low_privilege","summary":"A bug in OSV-SCALIBR causes a panic when scanning empty directories, leading to application crashes and denial of service.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Google","cpe":[],"cvss":{"score":1.9,"severity":"low","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P","version":"4.0"},"cwes":[{"id":"CWE-476","name":"NULL Pointer Dereference"}],"description":"A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":"2025-11-06","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2025-11-06T15:41:42Z","kind":"github_poc","ref":"https://github.com/0xXA/google-poc","stars":0,"title":"This repo contains instructions to reproduce CVE-2025-13425: Null Pointer dereference / Array over-indexing vulnerability that I found in Google's OSV-SCALIBR project."}],"tier":"poc_unverified"},"has_fix":true,"headline":"Denial of Service in OSV-SCALIBR","id":"CVE-2025-13425","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"null_dereference","year":"2025"},"n_packages":3,"n_references":1,"next":{"headline":"Improper Sandboxing in Google Apigee's JavaCallout Policy Allows for Remote Code Execution","id":"CVE-2025-13426"},"packages":[{"ecosystem":"Go","fixed":["0.3.4"],"introduced":["0"],"last_affected":[],"package":"github.com/google/osv-scalibr","purl":null,"source":"GHSA-f786-75f3-74xj"},{"ecosystem":"Go","fixed":["0.3.4"],"introduced":["0"],"last_affected":[],"package":"github.com/google/osv-scalibr","purl":"pkg:golang/github.com/google/osv-scalibr","source":"GHSA-f786-75f3-74xj"},{"ecosystem":"Go","fixed":["0.3.4"],"introduced":["0"],"last_affected":[],"package":"github.com/google/osv-scalibr","purl":"pkg:golang/github.com/google/osv-scalibr","source":"GO-2025-4149"}],"prev":{"headline":"Campcodes Supplier Management System add_product.php sql injection","id":"CVE-2025-13424"},"products":["OSV-SCALIBR"],"published":"2025-11-20","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-11-20","vendors":["Google"]},"summary":"A bug in OSV-SCALIBR causes a panic when scanning empty directories, leading to application crashes and denial of service.","url":"https://insights.sbomify.com/CVE-2025-13425/"}