CVE-2025-4759
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.4%
probabilidad de explotación
0.4%top 68% de las CVE
explotación observada
noninguna fuente lo reporta
Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:P
Productos afectados
n/a · lockfile-lint-apiReferencias
https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151fhttps://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js%23L51-L63https://github.com/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4cahttps://github.com/lirantal/lockfile-lint/pull/204https://security.snyk.io/vuln/SNYK-JS-LOCKFILELINTAPI-10169587