26 matches found
CVE-2025-56499
CVE-2025-56499 Arbitrary File Read via Missing Path Validation in Local Rule Provider Upstream Fix: https://github.com/MetaCubeX/mihomo/pull/2177 Affected Versions: mihomo = v1.19.11 Summary When parsing rule-providers configuration, the type = "file" branch fails to validate the supplied path. A...
OPENSUSE-SU-2026:12246-1 mihomo-1.19.33-1.1 on GA media
These are all security issues fixed in the mihomo-1.19.33-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-122915
These are all security issues fixed in the mihomo-1.19.33-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-80580
These are all security issues fixed in the mihomo-1.19.30-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2026:11532-1 mihomo-1.19.30-1.1 on GA media
These are all security issues fixed in the mihomo-1.19.30-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2026:11216-1 mihomo-1.19.28-1.1 on GA media
These are all security issues fixed in the mihomo-1.19.28-1.1 package on the GA media of openSUSE Tumbleweed...
EUVD-2025-198068
Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass in the process of obtaining the external control key from the configuration file. An attacker can access arbitrary files with elevated privileges by leveraging authenticated access with low-level privileges...
CVE-2025-56499
Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file...
CVE-2025-56499
Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file...
CVE-2025-56499
Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file...
CVE-2025-56499
The mihomo software (versions
Mihomo security vulnerabilities
mihomo is an open source API interface for MetaCubeX. A security vulnerability exists in mihomo version v1.19.11, which stems from improper access control and could lead to reading arbitrary files...
CVE-2025-56499: Improper Access Control
Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file...
PT-2025-47393
Name of the Vulnerable Software and Affected Versions mihomo version 1.19.11 Description An access control issue exists in mihomo version 1.19.11. Authenticated attackers with limited privileges can read arbitrary files with higher privileges. This is achieved by obtaining an external control key...
CVE-2025-56499
Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file...
EUVD-2025-25771
Malicious code in bioql PyPI...
CVE-2025-9474
A vulnerability was detected in Mihomo Party up to 1.8.1 on macOS. Affected is the function enableSysProxy of the file src/main/sys/sysproxy.ts of the component Socket Handler. The manipulation results in creation of temporary file with insecure permissions. The attack requires a local approach...
CVE-2025-9474
A vulnerability was detected in Mihomo Party up to 1.8.1 on macOS. Affected is the function enableSysProxy of the file src/main/sys/sysproxy.ts of the component Socket Handler. The manipulation results in creation of temporary file with insecure permissions. The attack requires a local approach...
CVE-2025-9474 Mihomo Party Socket sysproxy.ts enableSysProxy temp file
A vulnerability was detected in Mihomo Party up to 1.8.1 on macOS. Affected is the function enableSysProxy of the file src/main/sys/sysproxy.ts of the component Socket Handler. The manipulation results in creation of temporary file with insecure permissions. The attack requires a local approach...