CVE-2025-13425

Description

OSV-SCALIBR has NULL Pointer Dereference in github.com/google/osv-scalibr

How to fix CVE-2025-13425

To remediate CVE-2025-13425, upgrade the affected package to a fixed version below.

• Go/github.com/google/osv-scalibr—upgrade to 0.3.4 or later
• Go/github.com/google/osv-scalibr—upgrade to 0.3.4 or later

Is CVE-2025-13425 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 0.3.4
• from 0, < 0.3.4

CVSS scores

References (4)

• ADVISORYgithub.com/advisories/GHSA-f786-75f3-74xj
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-13425
• PATCHgithub.com/google/osv-scalibr
• WEBgithub.com/google/osv-scalibr/commit/e67c4e198ca099cb7c16957a80f6c5331d90a672