CVE-2025-67510

Katalog CVE

CVSS 9.4 · Critical EPSS 0,41%

Kerentanan Execution with Unnecessary Privileges pada neuron-ai neuron. Skor CVSS 3.1 9.4 (Critical) menurut github.com.

Deskripsi (NVD)

Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() + execute() without semantic restrictions. This is consistent with the name (“write tool”), but in an LLM/agent context it becomes a high-risk capability: prompt injection or indirect prompt manipulation can cause execution of destructive queries such as DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related statements (subject to DB permissions). Deployments that expose an agent with MySQLWriteTool enabled to untrusted input and/or run the tool with a DB user that has broad privileges are impacted. This issue is fixed in version 2.8.12.

Rincian

Terbit di NVD

10 Desember 2025

Terakhir diubah

25 September 2026

Status NVD

Analyzed

CVSS 3.1

9.4 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-250: Execution with Unnecessary Privileges
CWE-284: Improper Access Control

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/neuron-core/neuron-ai/security/advisories/GHSA-898v-775g-777c mitigasi · advisory vendor
• https://github.com/neuron-core/neuron-ai/commit/44bab85d92bf162898ee48d0bcef6ba0d29b59c9 patch
• https://github.com/neuron-core/neuron-ai/releases/tag/2.8.12 product · release notes