CVE-2025-36852

CVE-2025-36852 is a critical-severity vulnerability with a CVSS 4.0 base score of 9.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-829.

Key facts

Description

A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache (such as those using Amazon S3, Google Cloud Storage, or similar object storage) that allows any contributor with pull request privileges to inject compromised artifacts from an untrusted environment into trusted production environments without detection.  The vulnerability exploits a fundamental design flaw in the "first-to-cache wins" principle, where artifacts built in untrusted environments (feature branches, pull requests) can poison the cache used by trusted environments (protected branches, production deployments).  This attack bypasses all traditional security measures including encryption, access controls, and checksum validation because the poisoning occurs during the artifact construction phase, before any security measures are applied.

Frequently asked questions

What is CVE-2025-36852?
A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache (such as those using Amazon S3, Google Cloud Storage, or similar object storage) that allows any contributor with pull request privileges to inject compromised artifacts from an untrusted environment into trusted production environments without detection.  The vulnerability exploits a fundamental design flaw in the "first-to-cache wins" principle, where artifacts built in untrusted environments (feature branches, pull requests) can poison the cache used by trusted environments (protected branches, production deployments).  This attack bypasses all traditional security measures including encryption, access controls, and checksum validation because the poisoning occurs during the artifact construction phase, before any security measures are applied.
How severe is CVE-2025-36852?
CVE-2025-36852 has a CVSS 4.0 base score of 9.4, rated critical severity.
Is CVE-2025-36852 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-36852?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-36852 have an EU (EUVD) identifier?
Yes. CVE-2025-36852 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-17809.
When was CVE-2025-36852 published?
CVE-2025-36852 was published on 2025-06-10 and last updated on 2026-06-17.

References

Other CWE-829 vulnerabilities

Browse all CWE-829 vulnerabilities →