{"action":"Upgrade @webrecorder/archivewebpage to 0.15.4 or later.","affected":[{"fixed":"0.15.4","introduced":"0"}],"component":"@webrecorder/archivewebpage","cve_ids":["CVE-2025-58765"],"ecosystem":"npm","epss":0.00254,"exploited":false,"fixed_versions":["0.15.4"],"ghsa_id":"GHSA-w765-jm6w-4hhj","id":"tcs_01M5KGE8ST2JM6DR1M1XDGHJJ9","modified_at":"2025-09-10T17:13:45Z","published_at":"2025-09-10T17:13:45Z","references":["https://osv.dev/vulnerability/GHSA-w765-jm6w-4hhj","https://github.com/webrecorder/wabac.js/security/advisories/GHSA-w765-jm6w-4hhj","https://nvd.nist.gov/vuln/detail/CVE-2025-58765","https://github.com/webrecorder/archiveweb.page/pull/315","https://github.com/webrecorder/replayweb.page/pull/448","https://github.com/webrecorder/wabac.js/commit/25feb4a5af69a6b65694426eae67b890be438c4c","https://github.com/webrecorder/replayweb.page/releases/tag/v2.3.17","https://github.com/webrecorder/wabac.js","https://github.com/webrecorder/wabac.js/releases/tag/v2.23.11"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-w765-jm6w-4hhj#npm/@webrecorder/archivewebpage","url":"https://osv.dev/vulnerability/GHSA-w765-jm6w-4hhj"}],"summary":"Webrecorder packages are vulnerable to XSS through 404 error handling logic"}