What is the CVSS score of CVE-2025-61679?

CVE-2025-61679 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Anyquery are affected by CVE-2025-61679?

Anyquery SQL query engine versions 0.4.3 and below contain an unauthenticated local privilege escalation flaw that allows attackers with localhost access to extract sensitive integration data…. A patch is available.

How to fix or mitigate CVE-2025-61679?

Within 24 hours: Identify all systems running Anyquery versions 0.4.3 or below and isolate them or restrict localhost network access. Within 7 days: Upgrade all affected instances to Anyquery 0.4.4 or later. Within 30 days: Audit access logs for unauthorized localhost HTTP server requests and review integration credential rotation policies for affected services.

Anyquery CVE-2025-61679

EUVD-2025-33195 HIGH

Information Exposure (CWE-200)

2025-10-03 security-advisories@github.com

Information Disclosure

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:25 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

0.4.4

EUVD ID Assigned

Mar 13, 2026 - 19:29 euvd

EUVD-2025-33195

Analysis Generated

Mar 13, 2026 - 19:29 vuln.today

CVE Published

Oct 03, 2025 - 22:15 nvd

HIGH 7.7

DescriptionGitHub Advisory

Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low privileges, to use the http server through the port unauthenticated, and access private integration data like emails, without any warning of a foreign login from the provider. This issue is fixed in version 0.4.4.

Analysis

Technical ContextAI

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls. This vulnerability is classified as Information Exposure (CWE-200).