npm/misskey-js CVE-2025-66402: medium 6.5, EPSS 0.31%
misskey.js's export data contains private post data
Action: Upgrade misskey-js to 2025.12.0 or later.
npm i misskey-js@2025.12.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 13.0.0-beta.16 | 2025.12.0 | - |
Fixed versions
| 2025.12.0 |
Sources
- osv: GHSA-496g-mmpw-j9x3
- https://github.com/misskey-dev/misskey/security/advisories/GHSA-496g-mmpw-j9x3
- https://nvd.nist.gov/vuln/detail/CVE-2025-66402
- https://github.com/misskey-dev/misskey/commit/dc77d59f8712d3fe0b73cd4af2035133839cd57b
- https://github.com/misskey-dev/misskey
CVE-2025-66402 · published · modified · JSON