GHSA-6xvf-4vh9-mw47: Github.com/mindersec/minder Minder Does Not Sandbox Http.send Vulnerability
HIGH
CWE-830
Published
Advisory Summary
GHSA-6xvf-4vh9-mw47 is a HIGH minder does not sandbox http.send vulnerability (CWE-830: Inclusion of Web Functionality from an Untrusted Source) affecting Github.com/mindersec/minder libraries in the Go ecosystem. The issue involves minder does not sandbox http.send in rego programs. Remediation is available by upgrading affected packages to version 0.0.84.
GHSA-6xvf-4vh9-mw47 at a Glance
CVE Identifier
N/A
GHSA Identifier
GHSA-6xvf-4vh9-mw47
Severity
HIGH
CVSS v3.1 Base Score
N/A
CWE Classification
CWE-830: Inclusion of Web Functionality from an Untrusted Source
Affected Product
Github.com/mindersec/minder
Package Ecosystem
Go
Published Date
Last Updated
How to Fix GHSA-6xvf-4vh9-mw47
To remediate this vulnerability, upgrade all affected Github.com/mindersec/minder dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
github.com/mindersec/minder
fixed: 0.0.84
Upgrade github.com/mindersec/minder to 0.0.84
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/mindersec/minderHow to Check if You Are Affected
To determine whether your application is affected by GHSA-6xvf-4vh9-mw47, inspect your project dependencies for Github.com/mindersec/minder:
inspect dependencies for github.com/mindersec/minderAnalyze the terminal output to locate any version of Github.com/mindersec/minder in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.0.84), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-830: Inclusion of Web Functionality from an Untrusted Source, where the product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source. In Github.com/mindersec/minder, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
### Impact
Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to (for example, if the Minder server is behind a firewall or other network partition).
### Patches
https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8
### Workarounds
Users should avoid deploying Minder with access to sensitive resources. Unfortunately, this could include access to systems like OpenFGA or Keycloak, depending on the deployment configuration.
### References
Sample ruletype:
```yaml
version: v1
type: rule-type
name: test-http-send
display_name: Test that we can call http.send
short_failure_message: Failed http.send
severity:
value: medium
context:
provider: github
description: |
...
guidance: |
....
def:
in_entity: repository
rule_schema:
type: object
properties: {}
ingest:
type: git
git: {}
eval:
type: rego
violation_format: text
rego:
type: constraints
def: |
package minder
import rego.v1
violations contains {"msg": "Check-execution"}
resp := http.send({
"method": "GET",
"url": "http://openfga:8080/",
"raise_error": false,
})
violations contains {"msg": sprintf("Response: %s", [resp.status])}
details := sprintf("High score: %s", [resp.body.summary])
violations contains {"msg": sprintf("Response body: %s", [resp.body]) } if {
resp.status_code > 0
}
```
Example policy:
```yaml
version: v1
type: profile
name: Test-HTTP-send
display_name: Test if we can do http.send
context:
provider: github
alert: "off"
remediate: "off"
repository:
- type: test-http-send
def: {}
```
Evaluation results:
```sh
$ minder profile status list -n test-http-send --json
{
"profileStatus": {
"profileId": "3b3e0918-4deb-49cc-b4c9-1d1d912cf784",
"profileName": "Test-HTTP-send",
"profileStatus": "failure",
"lastUpdated": "2024-10-31T03:44:01.456359Z"
},
"ruleEvaluationStatus": [
{
"profileId": "3b3e0918-4deb-49cc-b4c9-1d1d912cf784",
"ruleId": "c0ebac2c-cfe2-4a98-b0a6-d6971209653e",
"ruleName": "test-http-send",
"entity": "repository",
"status": "failure",
"lastUpdated": "2024-10-31T03:44:01.456359Z",
"entityInfo": {
"entity_id": "a7f7a4bc-4430-4e9a-86a9-ffa026db6343",
"entity_type": "repository",
"name": "a-random-sandbox/colorls",
"provider": "github-app-a-random-sandbox",
"repo_name": "colorls",
"repo_owner": "a-random-sandbox",
"repository_id": "a7f7a4bc-4430-4e9a-86a9-ffa026db6343"
},
"details": "Multiple issues:\n* Check-execution\n* Response body: {\"code\": \"undefined_endpoint\", \"message\": \"Not Found\"}\n* Response: 404 Not Found\n",
"guidance": "....\n",
"remediationStatus": "skipped",
"remediationLastUpdated": "2024-10-31T03:44:01.456359Z",
"ruleTypeName": "test-http-send",
"ruleDescriptionName": "Test that we can call http.send",
"alert": {
"status": "skipped",
"lastUpdated": "2024-10-31T03:44:01.456359Z"
},
"ruleDisplayName": "Test that we can call http.send",
"releasePhase": "RULE_TYPE_RELEASE_PHASE_ALPHA"
}
]
}
```
GHSA-6xvf-4vh9-mw47 Affected Github.com/mindersec/minder Versions
1 component(s)
Fixed Versions:
0.0.84
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/mindersec/minder
|
Go |
≥ 0.0.72
< 0.0.84
|
0.0.84
|
References
GitHub Advisory / Wiki
ADVISORY
https://github.com/mindersec/minder/security/advisories/GHSA-6xvf-4vh9-mw47
Security Fix Commit
FIX COMMIT
https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8
Github.com/mindersec/minder Source Repository
REPOSITORY
https://github.com/mindersec/minder
Frequently Asked Questions
What is GHSA-6xvf-4vh9-mw47?
GHSA-6xvf-4vh9-mw47 is a security vulnerability in Github.com/mindersec/minder involving Minder does not sandbox http.send in Rego programs under CWE-830: Inclusion of Web Functionality from an Untrusted Source.
Which Github.com/mindersec/minder versions are affected?
Affected versions include releases prior to 0.0.84 across affected packages: github.com/mindersec/minder.
What version fixes GHSA-6xvf-4vh9-mw47?
Upgrading to 0.0.84 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/mindersec/minder affected?
Yes, github.com/mindersec/minder is affected in releases prior to 0.0.84. Upgrade your dependency to 0.0.84 or later.
What CWE is associated with GHSA-6xvf-4vh9-mw47?
GHSA-6xvf-4vh9-mw47 is classified under CWE-830: Inclusion of Web Functionality from an Untrusted Source (The product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.).
How can I check Go dependencies for GHSA-6xvf-4vh9-mw47?
Run the dependency tree command: 'inspect dependencies for github.com/mindersec/minder'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-6xvf-4vh9-mw47",
"modified" : "2025-11-20T21:57:01Z",
"published" : "2025-11-20T21:57:01Z",
"aliases" : [ ],
"summary" : "Minder does not sandbox http.send in Rego programs",
"details" : "### Impact\n\nMinder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to (for example, if the Minder server is behind a firewall or other network partition).\n\n### Patches\n\nhttps://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8\n\n### Workarounds\n\nUsers should avoid deploying Minder with access to sensitive resources. Unfortunately, this could include access to systems like OpenFGA or Keycloak, depending on the deployment configuration.\n\n### References\n\nSample ruletype:\n\n```yaml\nversion: v1\ntype: rule-type\nname: test-http-send\ndisplay_name: Test that we can call http.send\nshort_failure_message: Failed http.send\nseverity:\n value: medium\ncontext:\n provider: github\ndescription: |\n ...\nguidance: |\n ....\ndef:\n in_entity: repository\n rule_schema:\n type: object\n properties: {}\n ingest:\n type: git\n git: {}\n eval:\n type: rego\n violation_format: text\n rego:\n type: constraints\n def: |\n package minder\n\n import rego.v1\n\n violations contains {\"msg\": \"Check-execution\"}\n\n resp := http.send({\n \"method\": \"GET\",\n \"url\": \"http://openfga:8080/\",\n \"raise_error\": false,\n })\n\n violations contains {\"msg\": sprintf(\"Response: %s\", [resp.status])}\n\n details := sprintf(\"High score: %s\", [resp.body.summary])\n\n violations contains {\"msg\": sprintf(\"Response body: %s\", [resp.body]) } if {\n resp.status_code > 0\n }\n```\n\nExample policy:\n\n```yaml\nversion: v1\ntype: profile\nname: Test-HTTP-send\ndisplay_name: Test if we can do http.send\ncontext:\n provider: github\nalert: \"off\"\nremediate: \"off\"\nrepository:\n - type: test-http-send\n def: {}\n```\n\nEvaluation results:\n\n```sh\n$ minder profile status list -n test-http-send --json\n{\n \"profileStatus\": {\n \"profileId\": \"3b3e0918-4deb-49cc-b4c9-1d1d912cf784\",\n \"profileName\": \"Test-HTTP-send\",\n \"profileStatus\": \"failure\",\n \"lastUpdated\": \"2024-10-31T03:44:01.456359Z\"\n },\n \"ruleEvaluationStatus\": [\n {\n \"profileId\": \"3b3e0918-4deb-49cc-b4c9-1d1d912cf784\",\n \"ruleId\": \"c0ebac2c-cfe2-4a98-b0a6-d6971209653e\",\n \"ruleName\": \"test-http-send\",\n \"entity\": \"repository\",\n \"status\": \"failure\",\n \"lastUpdated\": \"2024-10-31T03:44:01.456359Z\",\n \"entityInfo\": {\n \"entity_id\": \"a7f7a4bc-4430-4e9a-86a9-ffa026db6343\",\n \"entity_type\": \"repository\",\n \"name\": \"a-random-sandbox/colorls\",\n \"provider\": \"github-app-a-random-sandbox\",\n \"repo_name\": \"colorls\",\n \"repo_owner\": \"a-random-sandbox\",\n \"repository_id\": \"a7f7a4bc-4430-4e9a-86a9-ffa026db6343\"\n },\n \"details\": \"Multiple issues:\\n* Check-execution\\n* Response body: {\\\"code\\\": \\\"undefined_endpoint\\\", \\\"message\\\": \\\"Not Found\\\"}\\n* Response: 404 Not Found\\n\",\n \"guidance\": \"....\\n\",\n \"remediationStatus\": \"skipped\",\n \"remediationLastUpdated\": \"2024-10-31T03:44:01.456359Z\",\n \"ruleTypeName\": \"test-http-send\",\n \"ruleDescriptionName\": \"Test that we can call http.send\",\n \"alert\": {\n \"status\": \"skipped\",\n \"lastUpdated\": \"2024-10-31T03:44:01.456359Z\"\n },\n \"ruleDisplayName\": \"Test that we can call http.send\",\n \"releasePhase\": \"RULE_TYPE_RELEASE_PHASE_ALPHA\"\n }\n ]\n}\n```",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/mindersec/minder"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0.0.72"
}, {
"fixed" : "0.0.84"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 0.0.83"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/mindersec/minder/security/advisories/GHSA-6xvf-4vh9-mw47"
}, {
"type" : "WEB",
"url" : "https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/mindersec/minder"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-830" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2025-11-20T21:57:01Z",
"nvd_published_at" : null
}
}