CVE-2025-64178: Github.com/jon4hz/jellysweep Jellysweep Uses Uncontrolled Data Vulnerability

HIGH
Advisory Identifier: GHSA-xc93-q32j-cpcg
Share
CWE-918
Published
Advisory Summary

CVE-2025-64178 is a HIGH jellysweep uses uncontrolled data vulnerability (CWE-918: Server-Side Request Forgery (SSRF)) affecting Github.com/jon4hz/jellysweep libraries in the Go ecosystem. The issue involves jellysweep uses uncontrolled data in image cache api endpoint. Remediation is available by upgrading affected packages to version 0.13.0.

CVE-2025-64178 at a Glance

CVE Identifier CVE-2025-64178
GHSA Identifier GHSA-xc93-q32j-cpcg
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-918: Server-Side Request Forgery (SSRF)
Affected Product Github.com/jon4hz/jellysweep
Package Ecosystem Go
Published Date
Last Updated

How to Fix CVE-2025-64178

To remediate this vulnerability, upgrade all affected Github.com/jon4hz/jellysweep dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/jon4hz/jellysweep fixed: 0.13.0 
Upgrade github.com/jon4hz/jellysweep to 0.13.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/jon4hz/jellysweep

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-64178, inspect your project dependencies for Github.com/jon4hz/jellysweep:

inspect dependencies for github.com/jon4hz/jellysweep

Analyze the terminal output to locate any version of Github.com/jon4hz/jellysweep in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.13.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-918: Server-Side Request Forgery (SSRF), where the web server receives a url or similar request from an upstream component and retrieves the contents of this url, but it does not sufficiently ensure that the request is being sent to the expected destination. In Github.com/jon4hz/jellysweep, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact The `/api/images/cache` which is used to download media posters from the server accepted an `url` parameter, which was directly passed to the cache package and that downloaded the poster from this URL. This URL parameter can be used to make the jellysweep server download arbitrary content. The API endpoint can only be used by authenticated users. ### Patches Fixed in `v0.13.0`. The affected (and now fixed) library was also moved to `internal/` because it wasn't meant to be imported. ### References https://github.com/jon4hz/jellysweep/security/code-scanning/28

CVE-2025-64178 Affected Github.com/jon4hz/jellysweep Versions

1 component(s)
Fixed Versions:
0.13.0
Product / Package Ecosystem Affected Versions Fixed Version
github.com/jon4hz/jellysweep
golang/github.com/jon4hz/jellysweep
Go
< 0.13.0
0.13.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/jon4hz/jellysweep/security/advisories/GHSA-xc93-q32j-cpcg
NVD — CVE-2025-64178 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-64178
Security Fix Commit FIX COMMIT
https://github.com/jon4hz/jellysweep/commit/17466312510966418aea941e4944229856d55101
Github.com/jon4hz/jellysweep Source Repository REPOSITORY
https://github.com/jon4hz/jellysweep

Frequently Asked Questions

What is CVE-2025-64178?
CVE-2025-64178 is a security vulnerability in Github.com/jon4hz/jellysweep involving Jellysweep uses uncontrolled data in image cache API endpoint under CWE-918: Server-Side Request Forgery (SSRF).
Which Github.com/jon4hz/jellysweep versions are affected?
Affected versions include releases prior to 0.13.0 across affected packages: github.com/jon4hz/jellysweep.
What version fixes CVE-2025-64178?
Upgrading to 0.13.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/jon4hz/jellysweep affected?
Yes, github.com/jon4hz/jellysweep is affected in releases prior to 0.13.0. Upgrade your dependency to 0.13.0 or later.
What CWE is associated with CVE-2025-64178?
CVE-2025-64178 is classified under CWE-918: Server-Side Request Forgery (SSRF) (The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.).
How can I check Go dependencies for CVE-2025-64178?
Run the dependency tree command: 'inspect dependencies for github.com/jon4hz/jellysweep'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xc93-q32j-cpcg",
  "modified" : "2025-11-07T16:40:49Z",
  "published" : "2025-11-04T14:30:22Z",
  "aliases" : [ "CVE-2025-64178" ],
  "summary" : "Jellysweep uses uncontrolled data in image cache API endpoint",
  "details" : "### Impact\nThe `/api/images/cache` which is used to download media posters from the server accepted an `url` parameter, which was directly passed to the cache package and that downloaded the poster from this URL.\nThis URL parameter can be used to make the jellysweep server download arbitrary content.\n\nThe API endpoint can only be used by authenticated users.\n\n### Patches\n\nFixed in `v0.13.0`. The affected (and now fixed) library was also moved to `internal/` because it wasn't meant to be imported.\n\n\n### References\nhttps://github.com/jon4hz/jellysweep/security/code-scanning/28",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/jon4hz/jellysweep"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.13.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/jon4hz/jellysweep/security/advisories/GHSA-xc93-q32j-cpcg"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-64178"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jon4hz/jellysweep/commit/17466312510966418aea941e4944229856d55101"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/jon4hz/jellysweep"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-918" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-11-04T14:30:22Z",
    "nvd_published_at" : "2025-11-06T22:15:44Z"
  }
}