CVE-2025-31363: Mattermost doesn't restrict domains LLM can request to contact upstream

April 16, 2025 (updated April 23, 2025)

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin’s Jira tool.

References

github.com/advisories/GHSA-9h6j-4ffx-cm84
github.com/mattermost/mattermost
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2025-31363
pkg.go.dev/vuln/GO-2025-3622

Code Behaviors & Features

Detect and mitigate CVE-2025-31363 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →