CVE-2025-62356_CVE-2025-62356

7.5 / 10

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

A path traversal vulnerability in all versions of the Qodo Qodo Gen IDE enables a threat actor to read arbitrary local files in and outside of current projects on an end user’s system. The vulnerability can be reached directly and through indirect prompt injection.

Basic Information

ID CVE-2025-62356

Source HiddenLayer

Published Oct 17, 2025 at 15:36

Modified Oct 17, 2025 at 15:48

Affected Product

Vendor Qodo

Product Qodo Gen

Version *

Affected Versions Qodo Qodo Gen *

CWE Classification

CWE-22

References

hiddenlayer.com /sai_security_advisor/2025-10-qodogen/

{
    "lastseen": "",
    "description": "A path traversal vulnerability in all versions of the Qodo Qodo Gen IDE enables a threat actor to read arbitrary local files in and outside of current projects on an end user\u2019s system. The vulnerability can be reached directly and through indirect prompt injection.",
    "published": "2025-10-17T15:36:12.710Z",
    "modified": "2025-10-17T15:48:52.236Z",
    "type": "cve",
    "title": "CVE-2025-62356",
    "source": "HiddenLayer",
    "references": "https://hiddenlayer.com/sai_security_advisor/2025-10-qodogen/",
    "id": "CVE-2025-62356",
    "bulletinFamily": "",
    "cwe": [
        "CWE-22"
    ],
    "cvelist": null,
    "sourceData": "Qodo Qodo Gen *",
    "sourceHref": "",
    "cvss": {
        "score": 7.5,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Qodo Gen",
    "version": "*",
    "vendor": "Qodo",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}