{"action":"Upgrade @webrecorder/wabac to 2.23.11 or later.","affected":[{"fixed":"2.23.11","introduced":"0"}],"component":"@webrecorder/wabac","cve_ids":["CVE-2025-58765"],"ecosystem":"npm","epss":0.00254,"exploited":false,"fixed_versions":["2.23.11"],"ghsa_id":"GHSA-w765-jm6w-4hhj","id":"tcs_01M5KGE8BF0W80VGK3WPG78NM2","modified_at":"2025-09-10T17:13:45Z","published_at":"2025-09-10T17:13:45Z","references":["https://osv.dev/vulnerability/GHSA-w765-jm6w-4hhj","https://github.com/webrecorder/wabac.js/security/advisories/GHSA-w765-jm6w-4hhj","https://nvd.nist.gov/vuln/detail/CVE-2025-58765","https://github.com/webrecorder/archiveweb.page/pull/315","https://github.com/webrecorder/replayweb.page/pull/448","https://github.com/webrecorder/wabac.js/commit/25feb4a5af69a6b65694426eae67b890be438c4c","https://github.com/webrecorder/replayweb.page/releases/tag/v2.3.17","https://github.com/webrecorder/wabac.js","https://github.com/webrecorder/wabac.js/releases/tag/v2.23.11"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-w765-jm6w-4hhj","url":"https://osv.dev/vulnerability/GHSA-w765-jm6w-4hhj"}],"summary":"Webrecorder packages are vulnerable to XSS through 404 error handling logic"}