{"data":{"id":"cc69fec2-7d19-47dd-9fae-792748da6a4e","title":"CVE-2025-59956: AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible…","summary":"CVE-2025-59956 affects AgentAPI, an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex, in versions 0.3.3 and below. When hosted over plain HTTP on localhost, these versions are susceptible to a client-side DNS rebinding attack that grants an attacker access to the /messages endpoint. The attacker can exfiltrate local message history, which may include secret keys, file system contents, and intellectual property.","solution":"Fixed in version 0.4.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-59956","publishedAt":"2025-09-30T11:37:41.743Z","cveId":"CVE-2025-59956","cweIds":["CWE-350","CWE-290"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/coder/agentapi@< 0.4.0 (fixed: 0.4.0)"],"affectedPackageNames":["github.com/coder/agentapi"],"affectedPackageRefs":["go:github.com/coder/agentapi"],"affectedVendors":[],"affectedVendorsRaw":["AgentAPI","Claude Code","Goose","Aider","Gemini","Amp","Codex"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"AgentAPI DNS rebinding exposes message history via localhost /messages endpoint","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00426,"epssCheckedAt":"2026-11-04T18:09:13.251Z","kevDateAdded":null,"advisoryAliases":["GHSA-w64r-2g3w-w8w4"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:28.245Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-08-13T09:21:47.000Z","daysToFix":-48,"fixCheckedAt":"2026-10-29T21:43:35.039Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/coder/agentapi","fixedVersion":"0.4.0","matchedVersion":"v0.4.0","fixReleasedAt":"2025-08-13T09:21:47.000Z","daysToFix":-48,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:43:34.888Z"}]}}