Security Notice: CVE-2025-66478 (Critical)
Date: December 3, 2025
Severity: Critical (CVSS 10.0)
CVE: CVE-2025-66478
Summary
A critical remote code execution (RCE) vulnerability has been identified in Next.js and React that affects Sourcebot versions 4.6.5 through 4.10.0 (inclusive). This vulnerability (CVE-2025-66478) exists in the React Flight protocol and could allow an attacker to execute arbitrary code on affected systems.
Affected Versions
The following Sourcebot versions are vulnerable and require immediate upgrade:
- 4.6.5 through 4.10.0 (all versions in this range)
Fixed Versions
- 4.10.1 and later (released December 3, 2025)
Recommended Action
Immediate upgrade required. All users running Sourcebot versions 4.6.5 through 4.10.0 should upgrade to version 4.10.1 or later immediately.
Additional Information
This vulnerability was fixed in Sourcebot v4.10.1 by updating Next.js to version 15.5.7 and React to version 19.2.1, which include the upstream security patches.
References
GitHub Security Advisory
CVE-2025-66478
Sourcebot Changelog
Questions or Concerns
If you have any questions or need assistance with the upgrade, please contact team@sourcebot.dev or open an issue on GitHub.
Note: Sourcebot versions 4.6.4 and earlier are not affected by this vulnerability, as they use Next.js 14.x and React 18, which are not impacted by this CVE.
What's Changed
- fix(web): Fix issue where quotes cannot be used within a query by @brendan-kellam in #629
- feat(worker): Add
ALWAYS_INDEX_FILE_PATTERNSenv var to specify files that should always be indexed by @brendan-kellam in #631 - fix discord link by @brendan-kellam in #634
- fix(web): Fix error when loading files with special characters by @brendan-kellam in #637
- fix(web): Ask sourcebot perf improvements by @brendan-kellam in #632
- fix(web): Fix issue where creating a new Ask thread would result in a 404 by @brendan-kellam in #641
- Shrink Docker image size by ~1/3 by removing unnecessary ops by @thespad in #642
- chore(web): Bake PostHog token into build by @brendan-kellam in #648
- chore(web): Scope code nav to current repository by default by @brendan-kellam in #647
- fix(web): Fix CVE 2025-55182 by @brendan-kellam in #654
- chore(web): Fix mistake of upgrading to a breaking version of next by @brendan-kellam in #656
- chore(web): Server side search telemetry by @brendan-kellam in #652
New Contributors
Full Changelog: v4.10.0...v4.10.1
