CVE-2025-4759

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-4759
Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151f Exploit
https://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js%23L51-L63 Broken Link
https://github.com/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca Patch
https://github.com/lirantal/lockfile-lint/pull/204 Patch
https://security.snyk.io/vuln/SNYK-JS-LOCKFILELINTAPI-10169587 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:lirantal:lockfile-lint-api:*:*:*:*:*:node.js:*:*
History

03 Jun 2025, 15:57

Type Values Removed Values Added
First Time Lirantal lockfile-lint-api
Lirantal
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:lirantal:lockfile-lint-api:*:*:*:*:*:node.js:*:*
References () https://github.com/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca - () https://github.com/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca - Patch
References () https://github.com/lirantal/lockfile-lint/pull/204 - () https://github.com/lirantal/lockfile-lint/pull/204 - Patch
References () https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151f - () https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151f - Exploit
References () https://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js%23L51-L63 - () https://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js%23L51-L63 - Broken Link
References () https://security.snyk.io/vuln/SNYK-JS-LOCKFILELINTAPI-10169587 - () https://security.snyk.io/vuln/SNYK-JS-LOCKFILELINTAPI-10169587 - Third Party Advisory

16 May 2025, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-16 05:15

Updated : 2025-06-03 15:57

NVD link : CVE-2025-4759

Mitre link : CVE-2025-4759

JSON object : View

Products Affected

lirantal

  • lockfile-lint-api
CWE
NVD-CWE-noinfo