{"metadata": {"vulnerability": "GHSA-JC7G-X28F-3V3H", "count": 14, "kinds": {"milestone": 3, "sighting": 5, "kev": 0, "other": 6}}, "data": [{"timestamp": "2025-06-02T10:39:41.634Z", "date_only": false, "value": "2025-06-02T10:39:41.634Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5 \u00b7 CVE-2025-49136", "record": "CVE-2025-49136", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-06-09T13:09:24Z", "date_only": false, "value": "2025-06-09T13:09:24Z", "kind": "milestone", "label": "Published", "source": "github", "record": "GHSA-JC7G-X28F-3V3H", "field": "published"}, {"timestamp": "2025-06-09T16:21:48.266Z", "date_only": false, "value": "2025-06-09T16:21:48.266Z", "kind": "milestone", "label": "Published", "source": "cvelistv5 \u00b7 CVE-2025-49136", "record": "CVE-2025-49136", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-06-09T16:21:48.266Z", "date_only": false, "value": "2025-06-09T16:21:48.266Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2025-49136 / GitHub_M", "record": "CVE-2025-49136", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-06-09T16:56:04Z", "date_only": false, "value": "2025-06-09T16:56:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/17703", "record": "GHSA-JC7G-X28F-3V3H", "field": "creation_timestamp", "uuid": "3ff52a96-8367-48a3-8e9a-173128d2a923", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-49136\n\ud83d\udd25 CVSS Score: 9.1 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)\n\ud83d\udd39 Description: listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.\n\ud83d\udccf Published: 2025-06-09T16:21:48.266Z\n\ud83d\udccf Modified: 2025-06-09T16:21:48.266Z\n\ud83d\udd17 References:\n1. https://github.com/knadh/listmonk/security/advisories/GHSA-jc7g-x28f-3v3h\n2. https://github.com/knadh/listmonk/commit/d27d2c32cf3af2d0b24e29ea5a686ba149b49b3e\n3. https://github.com/knadh/listmonk/releases/tag/v5.0.2", "url": "https://t.me/DarkWebInformer_CVEAlerts/17703"}, {"timestamp": "2025-06-09T17:04:30.684Z", "date_only": false, "value": "2025-06-09T17:04:30.684513Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/114654489485948868", "record": "GHSA-jc7g-x28f-3v3h", "field": "creation_timestamp", "uuid": "32a4643b-6fbb-4890-bc1d-587c2429de64", "url": "https://infosec.exchange/users/cR0w/statuses/114654489485948868"}, {"timestamp": "2025-06-09T17:15:29Z", "date_only": false, "value": "2025-06-09T17:15:29Z", "kind": "other", "label": "Nvd published at", "source": "github", "record": "GHSA-JC7G-X28F-3V3H", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-06-10T13:24:43.793Z", "date_only": false, "value": "2025-06-10T13:24:43.793880Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 \u00b7 CVE-2025-49136 / CISA-ADP", "record": "CVE-2025-49136", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2025-06-10T13:25:02.262Z", "date_only": false, "value": "2025-06-10T13:25:02.262Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2025-49136", "record": "CVE-2025-49136", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-06-10T13:25:02.262Z", "date_only": false, "value": "2025-06-10T13:25:02.262Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2025-49136 / CISA-ADP", "record": "CVE-2025-49136", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-06-10T19:59:04Z", "date_only": false, "value": "2025-06-10T19:59:04Z", "kind": "other", "label": "Updated", "source": "github", "record": "GHSA-JC7G-X28F-3V3H", "field": "modified"}, {"timestamp": "2026-01-24T21:30:38Z", "date_only": false, "value": "2026-01-24T21:30:38.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/2aeb9181d822da66f0341f802419d7a7", "record": "GHSA-jc7g-x28f-3v3h", "field": "creation_timestamp", "uuid": "32711a3b-9a37-403b-95a7-dd00acddf116", "url": "https://gist.github.com/alon710/2aeb9181d822da66f0341f802419d7a7"}, {"timestamp": "2026-01-24T21:30:40Z", "date_only": false, "value": "2026-01-24T21:30:40.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/128173bdf7a72d5dd0cfdf8f4e2ec93f", "record": "GHSA-jc7g-x28f-3v3h", "field": "creation_timestamp", "uuid": "c18197e5-052c-4f81-ac16-4038250913a5", "url": "https://gist.github.com/alon710/128173bdf7a72d5dd0cfdf8f4e2ec93f"}, {"timestamp": "2026-01-24T22:42:40Z", "date_only": false, "value": "2026-01-24T22:42:40.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/75bd805fd5fae660ad9e3111584de4d0", "record": "GHSA-jc7g-x28f-3v3h", "field": "creation_timestamp", "uuid": "d4e63a01-fc44-43f4-a645-eb75de91f8c5", "url": "https://gist.github.com/alon710/75bd805fd5fae660ad9e3111584de4d0"}]}