{"data":{"id":"d47ecd07-e0b3-499c-9509-29b309457eb3","title":"CVE-2025-3579: In versions prior to Aidex 1.7, an authenticated malicious user, taking advantage of an open registry, could execute…","summary":"CVE-2025-3579 affects Aidex versions prior to 1.7. An authenticated user, taking advantage of an open registry, can execute unauthorised commands on the system, including Unix OS commands and calls to internal services such as PHP or MySQL, and native functions of the Laravel or Symfony framework. The attack is carried out through Prompt Injection via the /api/<string-chat>/message endpoint by manipulating the 'content' parameter.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-3579","publishedAt":"2025-04-15T09:15:13.950Z","cveId":"CVE-2025-3579","cweIds":["CWE-94"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Aidex"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Aidex command execution through prompt injection in /api/<string-chat>/message","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00665,"epssCheckedAt":"2026-11-05T18:10:04.295Z","kevDateAdded":null,"advisoryAliases":["GHSA-2ff5-6f9m-635q"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-05T00:11:56.769Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[]}}