is there a version of sam-cli that doesn't trigger critical CVE-2025-68121? #8803
|
https://nvd.nist.gov/vuln/detail/cve-2025-68121 Looking for a version of sam-cli that works with python 3.10.12+ that doesn't trigger a critical vulnerability for CVE-2025-68121. The v1.155.2 tag fails as it comes with go stdlib 1.25.5, but the CVE isn't resolved until version 1.25.7. Experimenting with prior versions of sam-cli hasn't worked either (stdlib 1.24.13 would work too but I didn't find a version of sam-cli that delivers this either). The following files trigger the CVE:
Any insight or confirmation would be appreciated. Thanks very much! |
Answered by
valerena
Apr 3, 2026
Replies: 1 comment
|
Sorry for the delay, but version 1.156.0 addressed these vulnerabilities, by updating RIE to version 1.34 (which updated Go libraries to 1.25.8) |
0 replies
Answer selected by
vicheey
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Sorry for the delay, but version 1.156.0 addressed these vulnerabilities, by updating RIE to version 1.34 (which updated Go libraries to 1.25.8)