← Back

CVE-2026-25957

nvd nist
Published: Feb 9, 2026Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: security-advisories@github.com (Secondary)

Description

Cube is a semantic layer for building data applications. From 1.1.17 to before 1.5.13 and 1.4.2, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. This vulnerability is fixed in 1.5.13 and 1.4.2.

Affected (2)

Products: Cube: Cube.js
Cube
1 product
Cube.js
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Cube
Cube.js
From 1.1.17 to 1.4.2
Cube.js
From 1.5.0 to 1.5.13

Related CWEs

CWE-755
Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.

References (1)

Source: security-advisories@github.com
Vendor Advisory

Timeline

No history available yet.