CVE-2025-27155: In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim
Impact The Pinecone Simulator (pineconesim) included in Pinecone up to commit https://github.com/matrix-org/pinecone/commit/ea4c33717fd74ef7d6f49490625a0fa10e3f5bbc is vulnerable to stored cross-site scripting. The payload storage is not permanent and will be wiped when restarting pineconsim.
Patches Commit https://github.com/matrix-org/pinecone/commit/218b2801995b174085cb1c8fafe2d3aa661f85bd contains the fixes.
Workarounds N/A
For more information
If you have any questions or comments about this advisory, please email us at security at matrix.org.
Other sources
Pinecone is an experimental overlay routing protocol suite which is the foundation of the current P2P Matrix demos. The Pinecone Simulator (pineconesim) included in Pinecone up to commit ea4c337 is vulnerable to stored cross-site scripting. The payload storage is not permanent and will be wiped when restarting pineconesim.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
matrix-org/pinecone/pineconesimto a version that resolves this vulnerability.Patch 218b2801995b174085cb1c8fafe2d3aa661f85bd
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27155?
CVE-2025-27155 is classified as a medium severity vulnerability due to its potential impact on user data security.
How do I fix CVE-2025-27155?
To fix CVE-2025-27155, upgrade to the Pinecone Simulator version beyond commit ea4c337 where the vulnerability has been addressed.
What specific vulnerability is present in CVE-2025-27155?
CVE-2025-27155 involves a stored cross-site scripting vulnerability in the Pinecone Simulator.
Is CVE-2025-27155 present in all versions of Pinecone Simulator?
CVE-2025-27155 is only present in Pinecone Simulator versions up to and including commit ea4c337.
Who is affected by CVE-2025-27155?
Users of the Pinecone Simulator up to version ea4c337 are susceptible to CVE-2025-27155.