Recommended action

Monitor this advisory for an available fix and review any installs of the affected package.

hol-guard supply-chain scan

What this means

CISA ADP Vulnrichment affects n/a/n/a (generic). Severity is high. A CRLF injection vulnerability in Neto CMS v6.313.0 through v6.314.0 allows attackers to execute arbitrary code via supplying a crafted HTTP request.

AI coding agents often install or upgrade packages automatically in generic. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Evidence and references

• https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-28357.md

Recommended action

Monitor this advisory for an available fix and review any installs of the affected package.

hol-guard supply-chain scan

What this means

CISA ADP Vulnrichment affects n/a/n/a (generic). Severity is high. A CRLF injection vulnerability in Neto CMS v6.313.0 through v6.314.0 allows attackers to execute arbitrary code via supplying a crafted HTTP request.

AI coding agents often install or upgrade packages automatically in generic. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Evidence and references

• https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-28357.md