PT-2025-47589

Name of the Vulnerable Software and Affected Versions versions prior to 2025-13425 Description A flaw exists in the filesystem traversal fallback path, specifically within the fs/diriterate/diriterate.go:Next function. This issue causes an overindex on an empty slice when the ReadDir function...

CVE-2025-13425: NULL Pointer Dereference

A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic index out of range and an application crash denial of service in OSV-SCALIBR...

OSV-SCALIBR security vulnerabilities

OSV-SCALIBR is an open source software portfolio analysis library from Google. A security vulnerability exists in OSV-SCALIBR that stems from a file system traversal path error that could cause an application to crash...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +27 more potentially affected by CVE-2025-64757 via astro (>=5.0.0-beta.5, <=5.14.1)

astro NPM version =5.0.0-beta.5, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.0-dev-20250414184926, =1.13.2, =0.0.1, =0.0.1, =1.0.21, =1.0.22 - @vdart-code/web 1.19.0 and more Source cves: CVE-2025-64757 Source advisory: OSV:GHSA-X3H8-62X9-952G...

dora-tracing (>=0.3.2-rc1, <=0.3.13), holochain_tracing (>=0.0.21, <=0.0.24) +8 more potentially affected by unknown CVE via opentelemetry-jaeger (>=0.1.0, <=0.22.0)

opentelemetry-jaeger CARGO version =0.1.0, =0.3.2-rc1, =0.0.21, =0.0.21, =0.0.39, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.17.4 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0123...

abe_gpsw (>=0.2.4, <=2.0.0), ace-test-lib (0.1.0) +1963 more potentially affected by unknown CVE via gcc (>=0.3.35, <=0.3.55)

gcc CARGO version =0.3.35, =0.2.4, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.0.1, =0.1.2, =0.1.2, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0121...

@akunsansan0/tea_guntry99 (1.1.5), tea_guntry99 (>=1.1.2, <=1.1.6) potentially affected by unknown CVE via tea_guntry99 (1.1.7)

teaguntry99 NPM version 1.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on teaguntry99 and may be impacted: - @akunsansan0/teaguntry99 1.1.5 - teaguntry99 =1.1.2, =1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-181570...

@akunsansan0/tea_gunt99 (1.1.4) potentially affected by unknown CVE via tea_gunt99 (1.1.2)

teagunt99 NPM version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on teagunt99 and may be impacted: - @akunsansan0/teagunt99 1.1.4 Source cves: unknown CVE Source advisory: OSV:MAL-2025-181569...

@akunsansan0/jorelat (1.0.0), @akunsansan0/jorelat1 (1.0.0) +31 more potentially affected by unknown CVE via teagunup99 (1.1.5)

teagunup99 NPM version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on teagunup99 and may be impacted: - @akunsansan0/jorelat 1.0.0 - @akunsansan0/jorelat1 1.0.0 - @akunsansan0/jorelat10 1.0.0 - @akunsansan0/jorelat11 1.0.0 - @akunsansan0/jorelat...

@miftaikyy/rssosya (1.0.0), @miftaikyy/rssoya (1.0.0) potentially affected by unknown CVE via @miptaa02/vibas (1.1.4)

@miptaa02/vibas NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on @miptaa02/vibas and may be impacted: - @miftaikyy/rssosya 1.0.0 - @miftaikyy/rssoya 1.0.0 Source cves: unknown CVE Source advisory: OSV:MAL-2025-151001...

siddheshtea (1.1.6) potentially affected by unknown CVE via ruji-36 (1.0.0)

ruji-36 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ruji-36 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-165262...

siddheshtea (1.1.6) potentially affected by unknown CVE via ruji-28 (1.0.0)

ruji-28 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ruji-28 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-165253...

siddheshtea (1.1.6) potentially affected by unknown CVE via nokire-nakala37 (1.0.0)

nokire-nakala37 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nokire-nakala37 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-162990...

siddheshtea (1.1.6) potentially affected by unknown CVE via nokire-nakala39 (1.0.0)

nokire-nakala39 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nokire-nakala39 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-162992...

siddheshtea (1.1.6) potentially affected by unknown CVE via nokire-nakala76 (1.0.0)

nokire-nakala76 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nokire-nakala76 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-163032...

siddheshtea (1.1.6) potentially affected by unknown CVE via nokire-nakala7 (1.0.0)

nokire-nakala7 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nokire-nakala7 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-163025...

siddheshtea (1.1.6) potentially affected by unknown CVE via nokire-nakala3 (1.0.0)

nokire-nakala3 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nokire-nakala3 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-162982...

siddheshtea (1.1.6) potentially affected by unknown CVE via nokire-nakala83 (1.0.0)

nokire-nakala83 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nokire-nakala83 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-163040...

siddheshtea (1.1.6) potentially affected by unknown CVE via nokire-nakala78 (1.0.0)

nokire-nakala78 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nokire-nakala78 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-163034...

siddheshtea (1.1.6) potentially affected by unknown CVE via aji-18 (1.0.0)

aji-18 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on aji-18 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-152056...