10

CVE-2025-66478: jitsucom-jitsu

CVSS: 10.0v3.1CriticalRejected
AliasesCGA-3xwg-gq77-9xh8CGA-cvpm-337c-ph9vCGA-pfx2-vgqp-64mj
Published 03-12-2025Last modified 03-12-2025
Open JSON

Vulnerability summary

CVE-2025-66478 is a critical (CVSS 10.0) vulnerability in jitsucom-jitsu. 1 public exploit is recorded.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.1 (OSV · Wolfi), selected by version preference
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1metasploit

Advisory lineage

Upstream 1 · Downstream 0 · Related 2
GHSA-9QR9-H5GF-34MPCGA-3QRQ-JR55-42FVCGA-JM9H-35RG-MFFJ

Timeline

  1. 03-12-2025
    PublishedVulnerability first disclosed.
  2. 03-12-2025
    Last modifiedVulnerability information updated.

Description

Rejected reason: This CVE is a duplicate of CVE-2025-55182.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • MetasploitMetasploitremoteVerified

    Unauthenticated RCE in React Server Components (React2Shell)

    exploit/multi/http/react2shell_unauth_rce_cve_2025_55182

    Maturity: weaponized

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Chainguard7 products
  • jitsucom-jitsu< 2.11.0-r9
  • jitsucom-jitsu-console< 2.11.0-r9
  • jitsucom-jitsu-rotor< 2.11.0-r9
  • langfuse-3< 3.137.0-r0
  • langfuse-fips-3< 3.138.0-r0
Wolfi4 products
  • jitsucom-jitsu< 2.11.0-r9
  • jitsucom-jitsu-console< 2.11.0-r9
  • jitsucom-jitsu-rotor< 2.11.0-r9
  • langfuse-3< 3.137.0-r0

2 vendors · 11 products

References

5 links