CVE-2025-57806

Katalog CVE

CVSS 6.9 · Medium EPSS 0,07%

Kerentanan Cleartext Storage of Sensitive Information. Skor CVSS 4.0 6.9 (Medium) menurut github.com.

Deskripsi (NVD)

Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 stored confidential information, including API keys, in a local SQLite database without encryption. This behavior was not clearly documented outside of the database architecture page. Users were not given the ability to configure the database location, allowing anyone with access to the container or host filesystem to retrieve sensitive data in plaintext by accessing the .db file. This is fixed in version 1.0.0.

Rincian

Terbit di NVD

3 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 4.0

6.9 (Medium), sumber github.com
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-312: Cleartext Storage of Sensitive Information
CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,07% peluang dieksploitasi; lebih tinggi dari 0,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• http://github.com/LearningCircuit/local-deep-research/releases/tag/v1.0.0
• https://github.com/LearningCircuit/local-deep-research/pull/578
• https://github.com/LearningCircuit/local-deep-research/security/advisories/GHSA-4h8c-qrcq-cv5c