CVE-2025-61163
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests.
Risk Assessment
An attacker can exploit this vulnerability to perform cross-site request forgery (CSRF) attacks or data leakage, as the browser may send requests from untrusted domains.
Recommendation
Update North AI to the latest version that includes a fix for this vulnerability. Additionally, configure the server to validate the Origin header and restrict allowed domains.
Original NVD description (English source)
Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests.