CVE-2025-12758

Katalog CVE

CVSS 7.5 · High EPSS 0,52%

Kerentanan Incomplete Filtering of One or More Instances of Special Elements pada validator project validator. Skor CVSS 3.1 7.5 (High) menurut snyk.io.

Deskripsi (NVD)

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.

Rincian

Terbit di NVD

27 November 2025

Terakhir diubah

14 Juli 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber snyk.io
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-792: Incomplete Filtering of One or More Instances of Special Elements
CWE-172: Encoding Error

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/validatorjs/validator.js/pull/2616 issue tracking · patch
• https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e exploit · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476 exploit · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-14152011
• http://seclists.org/fulldisclosure/2026/Jan/27