npm/replaywebpage CVE-2025-58765: high 7.1, EPSS 0.25%
Webrecorder packages are vulnerable to XSS through 404 error handling logic
Action: Upgrade replaywebpage to 2.3.17 or later.
npm i replaywebpage@2.3.17Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.3.17 | - |
Fixed versions
| 2.3.17 |
Sources
- osv: GHSA-w765-jm6w-4hhj#npm/replaywebpage
- https://github.com/webrecorder/wabac.js/security/advisories/GHSA-w765-jm6w-4hhj
- https://nvd.nist.gov/vuln/detail/CVE-2025-58765
- https://github.com/webrecorder/archiveweb.page/pull/315
- https://github.com/webrecorder/replayweb.page/pull/448
- https://github.com/webrecorder/wabac.js/commit/25feb4a5af69a6b65694426eae67b890be438c4c
- https://github.com/webrecorder/replayweb.page/releases/tag/v2.3.17
- https://github.com/webrecorder/wabac.js
- https://github.com/webrecorder/wabac.js/releases/tag/v2.23.11
CVE-2025-58765 · published · modified · JSON