PT-2025-9685 · Pinecone · Pinecone

Treanglex · Published 2025-03-04 · Updated 2025-03-13 · CVE-2025-27155

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pinecone versions up to commit ea4c337

Description The issue concerns stored cross-site scripting in the Pinecone Simulator (pineconesim). The payload storage is temporary and will be deleted when pineconesim is restarted.

Recommendations For versions up to commit ea4c337, consider disabling the Pinecone Simulator until a fix is available to prevent potential exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2025-27155

GHSA-FR62-MG2Q-7WQV

GO-2025-3500

OPENSUSE-SU-2025:14889-1

Affected Products

Pinecone

References · 44

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27155.json · Exploit
• https://osv.dev/vulnerability/GHSA-fr62-mg2q-7wqv · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3500 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27155 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:14889-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27155 · Vendor Advisory
• https://github.com/matrix-org/pinecone/security/advisories/GHSA-fr62-mg2q-7wqv · Note
• https://github.com/matrix-org/pinecone/commit/218b2801995b174085cb1c8fafe2d3aa661f85bd · Note
• https://github.com/matrix-org/pinecone · Note
• https://suse.com/security/cve/CVE-2025-24806 · Note
• https://suse.com/security/cve/CVE-2025-25294 · Note
• https://suse.com/security/cve/CVE-2025-27090 · Note
• https://suse.com/security/cve/CVE-2025-24526 · Note
• https://pkg.go.dev/vuln/GO-2025-3500 · Note
• https://suse.com/security/cve/CVE-2025-25204 · Note