CVE-2025-64683: 
NixOS vulnerability analysis and mitigation

In JetBrains Hub before version 2025.3.104432, an information disclosure vulnerability was discovered via the Users API. The vulnerability was assigned CVE-2025-64683 and was disclosed on November 10, 2025. This security issue affects JetBrains Hub installations that have not been updated to the latest version (NVD Database).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) by NVD with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The CNA (JetBrains s.r.o.) initially assessed it with a CVSS score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is characterized by its network attack vector, low attack complexity, and requires no privileges or user interaction to exploit (NVD Database).

The primary impact of this vulnerability is the potential disclosure of information through the Users API. The confidentiality impact is rated as High according to the NVD assessment, while integrity and availability remain unaffected (NVD Database).

The vulnerability has been patched in JetBrains Hub version 2025.3.104432. Users are advised to upgrade to this version or later to mitigate the security risk (JetBrains Advisory).