CVE-2025-27155: In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-04 · updated 2026-06-17
Weakness: CWE-79

Description

Pinecone is an experimental overlay routing protocol suite which is the foundation of the current P2P Matrix demos. The Pinecone Simulator (pineconesim) included in Pinecone up to commit ea4c337 is vulnerable to stored cross-site scripting. The payload storage is not permanent and will be wiped when restarting pineconesim.

Affected products

matrix-org pinecone: before 218b2801995b174085cb1c8fafe2d3aa661f85bd

References

https://github.com/matrix-org/pinecone/commit/218b2801995b174085cb1c8fafe2d3aa661f85bd
https://github.com/matrix-org/pinecone/security/advisories/GHSA-fr62-mg2q-7wqv

Get alerted when CVE-2025-27155 or the next vulnerability affects your stack