Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2025-69443 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Remote Code Execution in coleam00 Archon 0.1.0. A crafted HTML page, when accessed by a victim, can execute commands, run prompts on behalf of the user, control the Archon UI features, and steal all Archon information available on the UI including API keys.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:9.6 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CNA: CISA-ADPCVSS-B:6.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/coleam00/Archon	[email protected]	ProductSource CodeVendor
https://www.ox.security/blog/archon-remote-code-execution	[email protected]	Content Wall
https://www.ox.security/blog/cve-2025-69443-archon-os-vulnerable-to-unauthenticated-web-to-client-attack/	[email protected]	AdvisoryExploitRemedy

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-94	Improper Control of Generation of Code ('Code Injection')	CISA-ADP

Affected Products

Product	Versions
coleam00 Archon	>= 0.1.0, <= 0.3.11 (semver)
CPE cpe:2.3:a:archon:archon:::::::: cpe:2.3:a:archon_project:archon:::::::: Remediation Mitigation:low effort Bind port 8181 explicitly to 127.0.0.1 and restrict access via firewall rules. Mitigation:low effort Do not store sensitive API keys in Archon until authentication is implemented on the backend. Mitigation:low effort Avoid running unauthenticated local services that handle credentials or can act on your behalf.

Product

Versions

coleam00 Archon

>= 0.1.0, <= 0.3.11 (semver)

CPE

cpe:2.3:a:archon:archon:*:*:*:*:*:*:*:*
cpe:2.3:a:archon_project:archon:*:*:*:*:*:*:*:*

Remediation

Mitigation:low effort
Bind port 8181 explicitly to 127.0.0.1 and restrict access via firewall rules.
Mitigation:low effort
Do not store sensitive API keys in Archon until authentication is implemented on the backend.
Mitigation:low effort
Avoid running unauthenticated local services that handle credentials or can act on your behalf.

Change History

4 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
May 15, 2026	CVE Modified	CISA-ADP
May 14, 2026	New CVE Received	[email protected]