CVE-2025-4759

Katalog CVE

CVSS 5.3 · Medium EPSS 0,44%

Kerentanan Incorrect Behavior Order: Early Validation pada lirantal lockfile-lint-api. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.

Rincian

Terbit di NVD

16 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-179: Incorrect Behavior Order: Early Validation

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca patch
• https://github.com/lirantal/lockfile-lint/pull/204 patch
• https://security.snyk.io/vuln/SNYK-JS-LOCKFILELINTAPI-10169587 advisory pihak ketiga
• https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151f exploit
• https://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint... broken link