What is CVE-2025-47775?

CVE-2025-47775 is a medium-severity vulnerability in Bullfrogsec Bullfrog, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 6.2/10. Published 2025-05-14.

How severe is CVE-2025-47775?

Medium severity. CVSS v3 base score is 6.2 out of 10.

Vulnerability in Bullfrogsec Bullfrog

CVE-2025-47775

Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.

EPSS: 0.004 (31.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Bullfrogsec Bullfrog — versions < 0.8.4

Weakness classification (CWE)

CWE-201 — Insertion of Sensitive Information into Sent Data

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2025-47775?: CVE-2025-47775 is a medium-severity vulnerability in Bullfrogsec Bullfrog, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 6.2/10. Published 2025-05-14.
How severe is CVE-2025-47775?: Medium severity. CVSS v3 base score is 6.2 out of 10.