{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59691 exists.","fix":"Upgrade to a fixed version.","what":"CVE-2025-59691 is a low-severity vulnerability in PureVPN, published on 18 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-59691 and fix it if it is affected.\n\nWhat it is: CVE-2025-59691 is a low-severity vulnerability in PureVPN, published on 18 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59691 exists.\n\nAffected product: PureVPN. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-59691/ (Markdown: https://insights.sbomify.com/CVE-2025-59691/index.md)","id":"CVE-2025-59691","markdown":"https://insights.sbomify.com/CVE-2025-59691/index.md","name":"CVE-2025-59691","record":{"aliases":["GHSA-w9w7-whq2-rr8h","ROOT-OS-UBUNTU-2204-CVE-2025-59691"],"analysis":{"component_type":"desktop_application","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"PureVPN client","requires_auth":"none","summary":"PureVPN Linux clients leak IPv6 traffic during network events, exposing real IP addresses and bypassing privacy protections.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mitre","cpe":[],"cvss":{"score":3.7,"severity":"low","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-669","name":"Incorrect Resource Transfer Between Spheres"}],"description":"PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon network events such as Wi-Fi reconnect or system resume. In the CLI client, the VPN auto-reconnects and claims to be connected, but IPv6 traffic is no longer routed or blocked. In the GUI client, the IPv6 connection remains functional after disconnection until the user clicks Reconnect. In both cases, the real IPv6 address is exposed to external services, violating user privacy and defeating the advertised IPv6 leak protection. This affects CLI 2.0.1 and GUI 2.10.0.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Information disclosure in PureVPN","id":"CVE-2025-59691","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"information_disclosure","year":"2025"},"n_packages":0,"n_references":1,"next":{"headline":"Misconfiguration in PureVPN","id":"CVE-2025-59692"},"packages":[],"prev":{"headline":"Libraesva Email Security Gateway Command Injection","id":"CVE-2025-59689"},"products":["PureVPN"],"published":"2025-09-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-09-19","vendors":["PureVPN"]},"summary":"PureVPN Linux clients leak IPv6 traffic during network events, exposing real IP addresses and bypassing privacy protections.","url":"https://insights.sbomify.com/CVE-2025-59691/"}