Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-48140: MetalpriceAPI can let attackers execute arbitrary code

CVE-2025-48140 · published 1 year ago

Summary

Versions of MetalpriceAPI up to 1.1.4 can be tricked into running code that an attacker supplies. This could let a malicious user take control of the server or access sensitive information. Upgrade to a fixed version or apply the vendor's patch and ensure all input is strictly validated.

Original advisory text

Improper Control of Generation of Code ('Code Injection') vulnerability in metalpriceapi MetalpriceAPI metalpriceapi allows Code Injection.This issue affects MetalpriceAPI: from n/a through <= 1.1.4.

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-94Code Injection

Timeline

Published9 Jun 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-48140 · NVD

Track software like this

Free during beta