CVE-2025-48491

Project AI API Key Exposure in Source Code

Description

Project AI is a platform designed to create AI agents. Prior to the pre-beta version, a hardcoded API key was present in the source code. This issue has been patched in the pre-beta version.

Category

2.7
CVSS
Severity: Low
CVSS 4.0 •
EPSS 0.10%
Affected: aryan6673 project-ai
Published at:
Updated at:

References

Link Tags
https://github.com/aryan6673/project-ai/security/advisories/GHSA-8486-vrcp-69rv
https://github.com/aryan6673/project-ai/commit/142252c43f1dacb3fed99e3336f5cd863b028bc2
https://github.com/aryan6673/project-ai/commit/1de910f353eb2a68c980149b906e7495459296ad
https://github.com/aryan6673/project-ai/commit/54a69c3ccd301d35f3d54f4844d9910e609beb73
https://github.com/aryan6673/project-ai/commit/7f3b93f9aa9085d5413b4019172b0e56676346d7
https://github.com/aryan6673/project-ai/commit/8db90e3d9777850741804533ebde5824b4a5795c
https://github.com/aryan6673/project-ai/commit/99e0e0718edb0e59c5d3c5a69903b87c69fcfe7a
https://github.com/aryan6673/project-ai/commit/ab67979a46b0e343dc20a95a2b65d3c4994c31e7
https://github.com/aryan6673/project-ai/commit/c1fb156418d98a1e6c60bb680db57e9558785093

Frequently Asked Questions

What is the severity of CVE-2025-48491?
CVE-2025-48491 has been scored as a low severity vulnerability.
How to fix CVE-2025-48491?
To fix CVE-2025-48491, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-48491 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2025-48491 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-48491?
CVE-2025-48491 affects aryan6673 project-ai.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.