BlackTreeIndependent security intelligenceUnknown · Unknown
Medium technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.
Medium technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.
Fix not verifiedA flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
The product generates an error message that includes sensitive information about its environment, users, or associated data.
An attacker operating through a network path may attempt exploitation without authentication after a user interaction. If successful, the issue may obtain information outside the intended access boundary.
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
The product generates an error message that includes sensitive information about its environment, users, or associated data.
An attacker operating through a network path may attempt exploitation without authentication after a user interaction. If successful, the issue may obtain information outside the intended access boundary.
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.
CISA Vulnrichment records proof-of-concept exploitation in its SSVC data. BlackTree has not independently executed or validated exploit material.
CWE-209: Generation of Error Message Containing Sensitive Information. The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NCommon Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
Operational remediation based on structured source evidence.
Published 26 Jan 2026 · Last source change 29 Jun 2026, 23:28 UTC · CWE-209 · Generation of Error Message Containing Sensitive Information
Missing structured fields: affected product. Missing data is not evidence of low risk; review the primary advisory.
No material field changes have been recorded since change tracking began. Routine source refreshes and cosmetic edits are intentionally excluded.