In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim
Priority LOW 27CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Pinecone is an experimental overlay routing protocol suite which is the foundation of the current P2P Matrix demos. The Pinecone Simulator (pineconesim) included in Pinecone up to commit ea4c337 is vulnerable to stored cross-site scripting. The payload storage is not permanent and will be wiped when restarting pineconesim.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix Fixed pinecone (matrix-org): 218b2801995b174085cb1c8fafe2d3aa661f85bd
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| matrix-org | pinecone | before 218b2801995b174085cb1c8fafe2d3aa661f85bd | 218b2801995b174085cb1c8fafe2d3aa661f85bd | Patch available | CNA |
| — | github.com/matrix-org/pinecone (Go) | up to 0.11.0 | — | No fix listed | GHSA-fr62-mg2q-7wqv |
- pinecone Vendormatrix-org Affected before 218b2801995b174085cb1c8fafe2d3aa661f85bd Fixed in 218b2801995b174085cb1c8fafe2d3aa661f85bd Patch available CNA
- github.com/matrix-org/pinecone (Go) Vendor— Affected up to 0.11.0 Fixed in — No fix listed GHSA-fr62-mg2q-7wqv
Remediation
- Fix · CNA pinecone (matrix-org) Fixed in 218b2801995b174085cb1c8fafe2d3aa661f85bd
Timeline
- 2026-10-02 Threatist record created from CVE-2025-27155
- 2026-10-03 Alias added: GHSA-fr62-mg2q-7wqv
References
More matrix-org vulnerabilities
- TI-2023-20035 Sydent does not verify email server certificates CVSS 3.1CRITICAL 9.3
- TI-2026-45046 Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint CVSS 4.0MEDIUM 6.9
- TI-2026-45045 Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint CVSS 4.0HIGH 7.1
- TI-2026-45047 Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure CVSS 4.0MEDIUM 5.3
- TI-2023-15617 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites CVSS 3.1MEDIUM 5.0
- TI-2023-20039 matrix-appservice-irc IRC command injection via admin commands containing newlines CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-27155 · CVE Program
- CVE-2025-27155 · NVD
- FIRST EPSS
- GHSA-fr62-mg2q-7wqv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences