« Volver al listado

CVE-2026-25957

Estado: AnalizadaMedia (6.5)—

Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cube — Cube.js

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-25957",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25957",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-11T21:23:41.305758Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "cube-js",
          "product": "cube",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.1.17, < 1.4.2"
            },
            {
              "status": "affected",
              "version": ">= 1.5.0, < 1.5.13"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-09T23:16:06.780",
  "references": [
    {
      "url": "https://github.com/cube-js/cube/security/advisories/GHSA-9vph-2hvm-x66g",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-755"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2."
    },
    {
      "lang": "es",
      "value": "Cube es una capa semántica para construir aplicaciones de datos. Desde la versión 1.1.17 hasta antes de la 1.5.13 y la 1.4.2, es posible inhabilitar la totalidad de la API de Cube mediante el envío de una solicitud especialmente diseñada a un endpoint de la API de Cube. Esta vulnerabilidad está corregida en las versiones 1.5.13 y 1.4.2."
    }
  ],
  "lastModified": "2026-06-17T10:25:29.407",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cube:cube.js:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDBEFAB8-9209-469F-B40A-3212CE2D83D2",
              "versionEndExcluding": "1.4.2",
              "versionStartIncluding": "1.1.17"
            },
            {
              "criteria": "cpe:2.3:a:cube:cube.js:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE6B3000-94CC-46CE-BA90-87D559D6F536",
              "versionEndExcluding": "1.5.13",
              "versionStartIncluding": "1.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}