CVE-2025-27155: In-memory Stored XSS Vulnerability in github.com/matrix-org/pinecone
Summary
CVE-2025-27155: In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim in github.com/matrix-org/pinecone. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Pinecone is a Go-based package developed by the Matrix organization, designed to facilitate real-time communication and data synchronization. It is widely used in applications that require efficient handling of user data and interactions. However, like many web applications, it is susceptible to security vulnerabilities, including Cross-site Scripting (XSS), which can compromise user data and application integrity.
Vulnerability Detail
The vulnerability identified as CVE-2025-27155 is an in-memory stored Cross-site Scripting (XSS) issue within the pineconesim component of the pinecone package. This vulnerability allows an attacker to inject malicious scripts into the application, which can be executed in the context of other users. The origin of this vulnerability lies in improper sanitization of user inputs, leading to potential data theft, session hijacking, and other malicious activities. The ramifications of this vulnerability can be severe, affecting user trust and application security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization on user inputs to prevent the execution of malicious scripts. For example, you can use libraries such as 'html/template' in Go to escape user inputs before rendering them in the application. Here’s a simple code snippet:
import "html/template"
func renderTemplate(w http.ResponseWriter, data string) {
t := template.New("template")
t, _ = t.Parse("<div>{{.}}</div>")
t.Execute(w, template.HTMLEscapeString(data))
}
Conclusion
The CVE-2025-27155 vulnerability in the pinecone package presents significant security risks due to its in-memory stored XSS nature. It is crucial for developers to update their packages promptly and implement necessary security measures to protect user data.
See every vulnerability recorded for github.com/matrix-org/pinecone →
FAQ
CVE-2025-27155 is a vulnerability in the pinecone package that allows for in-memory stored Cross-site Scripting (XSS), potentially compromising user data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The risks include data theft, session hijacking, and loss of user trust, which can severely impact the application's reputation.
Yes, updating to the latest version of the pinecone package will address this vulnerability.
Implement input validation and sanitization as a temporary workaround to mitigate the risk until you can update.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
