CVE-2025-35436— CISA Thorium account verification email error handling
Quick assessment
Affected
CISA Thorium
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
thorium是mjcarson个人开发者的一个可扩展的文件分析和数据生成平台。 thorium存在安全漏洞，该漏洞源于使用unwrap处理错误，可能导致未经验证的远程攻击者通过特制电子邮件地址或响应导致崩溃。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-35436
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CISA Thorium account verification email error handling
Source: CVE Program / CVE List V5
Vulnerability Description
CISA Thorium uses '.unwrap()' to handle errors related to account verification email messages. An unauthenticated remote attacker could cause a crash by providing a specially crafted email address or response. Fixed in commit 6a65a27.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5
Vulnerability Title
thorium 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
thorium是mjcarson个人开发者的一个可扩展的文件分析和数据生成平台。 thorium存在安全漏洞，该漏洞源于使用unwrap处理错误，可能导致未经验证的远程攻击者通过特制电子邮件地址或响应导致崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-35436
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-35436
请登录查看更多情报信息。
Same Patch Batch · CISA · 2025-09-17 · 7 CVEs total
| CVE-2025-35431 | 5.4 MEDIUM | CISA Thorium LDAP injection |
| CVE-2025-35432 | 5.3 MEDIUM | CISA Thorium does not rate limit account verification email messages |
| CVE-2025-35430 | 5.0 MEDIUM | CISA Thorium insecure downloaded file path validation |
| CVE-2025-35433 | 5.0 MEDIUM | CISA Thorium does not properly invalidate previously used tokens |
| CVE-2025-35435 | 4.3 MEDIUM | CISA Thorium download stream divide by zero |
| CVE-2025-35434 | 4.2 MEDIUM | CISA Thorium does not validate TLS connections to Elasticsearch |
IV. Related Vulnerabilities
Same product: Thorium
-
CVE-2025-35435
CISA Thorium download stream divide by zero -
CVE-2025-35434
CISA Thorium does not validate TLS connections to Elasticsea -
CVE-2025-35433
CISA Thorium does not properly invalidate previously used to -
CVE-2025-35432
CISA Thorium does not rate limit account verification email -
CVE-2025-35431
CISA Thorium LDAP injection
Same weakness: CWE-248
-
CVE-2026-103387
garycourt uri-js Mailto Header mailto.ts URI.parse uncaught -
CVE-2026-102984
Astro: Malformed port in the Host header can crash the Node -
CVE-2026-96274
Uncaught exception in Baicells Nova 430H -
CVE-2026-102281
Nest: Remote process termination via a deeply nested microse -
CVE-2026-101918
PyJWT: Unauthenticated RecursionError DoS in pre-verificatio
V. Comments for CVE-2025-35436
No comments yet