CVE-2025-11864: Nucleoid 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.7.7, 0.7.8, 0.7.9, 0.7.10

Affected technology

Nucleoid · 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.7.7, 0.7.8, 0.7.9, 0.7.10
NucleoidAI

Description’s affected range: up to 0.7.10

Component: Outbound Request Handler
Function: extension.apply
File: /src/cluster.ts

Attack conditions (VulDB, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

VulDB’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality, integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.