Medium severity6.1OSV Advisory· Published Mar 4, 2025· Updated Apr 15, 2026

CVE-2025-27155

Description

Pinecone is an experimental overlay routing protocol suite which is the foundation of the current P2P Matrix demos. The Pinecone Simulator (pineconesim) included in Pinecone up to commit ea4c337 is vulnerable to stored cross-site scripting. The payload storage is not permanent and will be wiped when restarting pineconesim.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/matrix-org/pineconeGo	<= 0.11.0	—

Affected products

Matrix Org/PineconeOSV
Range: v0.1.0, v0.10.0, v0.11.0, …
ghsa-coords2 versions
pkg:golang/github.com/matrix-org/pinecone pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
<= 0.11.0+ 1 more
- (no CPE)range: <= 0.11.0
- (no CPE)range: < 0.0.20250312T181707-1.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-fr62-mg2q-7wqvghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-27155ghsaADVISORY
github.com/matrix-org/pinecone/commit/218b2801995b174085cb1c8fafe2d3aa661f85bdnvdWEB
github.com/matrix-org/pinecone/security/advisories/GHSA-fr62-mg2q-7wqvnvdWEB
pkg.go.dev/vuln/GO-2025-3500ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000