{"schema_version":"1.7.3","id":"GO-2025-3660","published":"2025-05-05T16:14:33Z","modified":"2026-02-04T04:36:32.590498Z","aliases":["CVE-2025-46569","GHSA-6m8w-jc87-6cr7"],"related":["CGA-9wmx-2228-q73c"],"summary":"OPA server Data API HTTP path injection of Rego in github.com/open-policy-agent/opa","details":"OPA server Data API HTTP path injection of Rego in github.com/open-policy-agent/opa","affected":[{"package":{"name":"github.com/open-policy-agent/opa","ecosystem":"Go","purl":"pkg:golang/github.com/open-policy-agent/opa"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/open-policy-agent/opa/v1/server","symbols":["Server.makeRego","Server.unversionedGetHealthWithPolicy","Server.v0QueryPath","baseHTTPListener.ListenAndServe","baseHTTPListener.ListenAndServeTLS","stringPathToDataRef","stringPathToRef"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2025-3660.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/open-policy-agent/opa/security/advisories/GHSA-6m8w-jc87-6cr7"},{"type":"FIX","url":"https://github.com/open-policy-agent/opa/commit/ad2063247a14711882f18c387a511fc8094aa79c"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2025-3660"}}