CVE-2025-4759

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-4759
Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.

8.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References
Link Resource
https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151f Exploit
https://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js%23L51-L63 Broken Link
https://github.com/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca Patch
https://github.com/lirantal/lockfile-lint/pull/204 Patch
https://security.snyk.io/vuln/SNYK-JS-LOCKFILELINTAPI-10169587 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:lirantal:lockfile-lint-api:*:*:*:*:*:node.js:*:*
History

03 Jun 2025, 15:57

Type Values Removed Values Added
References () https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151f - () https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151f - Exploit
References () https://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js%23L51-L63 - () https://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js%23L51-L63 - Broken Link
References () https://github.com/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca - () https://github.com/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca - Patch
References () https://github.com/lirantal/lockfile-lint/pull/204 - () https://github.com/lirantal/lockfile-lint/pull/204 - Patch
References () https://security.snyk.io/vuln/SNYK-JS-LOCKFILELINTAPI-10169587 - () https://security.snyk.io/vuln/SNYK-JS-LOCKFILELINTAPI-10169587 - Third Party Advisory
First Time Lirantal lockfile-lint-api
Lirantal
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:lirantal:lockfile-lint-api:*:*:*:*:*:node.js:*:*

16 May 2025, 14:42

Type Values Removed Values Added
Summary
  • (es) Las versiones del paquete lockfile-lint-api anteriores a 5.9.2 son vulnerables a Orden de comportamiento incorrecto: validación temprana a través del atributo resuelto de la validación de URL del paquete, que se puede omitir extendiendo el nombre del paquete, lo que permite que un atacante instale otros paquetes npm distintos al deseado.

16 May 2025, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-16 05:15

Updated : 2025-06-03 15:57

NVD link : CVE-2025-4759

Mitre link : CVE-2025-4759

CVE.ORG link : CVE-2025-4759

JSON object : View

Products Affected

lirantal

  • lockfile-lint-api
CWE
CWE-179

Incorrect Behavior Order: Early Validation

NVD-CWE-noinfo