npm/@webrecorder/wabac CVE-2025-58765: high 7.1, EPSS 0.25%

Webrecorder packages are vulnerable to XSS through 404 error handling logic

Action: Upgrade @webrecorder/wabac to 2.23.11 or later.

npm i @webrecorder/wabac@2.23.11

Affected

Fixed versions

Sources

• osv: GHSA-w765-jm6w-4hhj
• https://github.com/webrecorder/wabac.js/security/advisories/GHSA-w765-jm6w-4hhj
• https://nvd.nist.gov/vuln/detail/CVE-2025-58765
• https://github.com/webrecorder/archiveweb.page/pull/315
• https://github.com/webrecorder/replayweb.page/pull/448
• https://github.com/webrecorder/wabac.js/commit/25feb4a5af69a6b65694426eae67b890be438c4c
• https://github.com/webrecorder/replayweb.page/releases/tag/v2.3.17
• https://github.com/webrecorder/wabac.js
• https://github.com/webrecorder/wabac.js/releases/tag/v2.23.11

CVE-2025-58765 · published 2025-09-10T17:13:45Z · modified 2025-09-10T17:13:45Z · JSON