CVE-2025-64185: Osc Ondemand

Medium severity, CVSS 6.9. EPSS: 0.3% chance of exploitation in the next 30 days.

Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEM_PATH. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.

Affected products

• Osc Ondemand: before 4.0.8 (fixed in 4.0.8); before 3.1.16 (fixed in 3.1.16)

Published 2025-11-20. Last modified 2026-06-17.