~ / search / GHSA-f786-75f3-74xj

GHSA-f786-75f3-74xj

OSV-SCALIBR has NULL Pointer Dereference

Source: GitHub Advisory Database (reviewed) Low CVE-2025-13425

Packages

EcosystemPackageAffectedFixed in
Go github.com/google/osv-scalibr < 0.3.4 0.3.4

Details

As written in the advisory (Markdown source, shown as plain text).

A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.

References

External links from the advisory. They lead to third-party sites.