A remote‑code‑execution flaw in a third‑party JSON‑schema validator made its way into a live API last winter. The service was a Go‑based REST gateway, exposed to the public internet, and the CVE (CVE‑2025‑12345) let an attacker spin up code on the container host. The library’s fix landed in v2.1.0, but our pipeline still pulled v2.0.3. The attack happened before we even noticed.
Below is the real‑world story, what we did to stop it, and the trade‑offs we had to juggle. Grab a coffee, read on, and take notes for your own stack.
[Read More]