CVE-2025-4759
CVE-2025-4759
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.
CVSS 6.9 · Moyenne · EPSS 0,4% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
lockfile-lint-api
- Versions du logiciel
- ≥ 0, < 5.9.2: Concernée (semver)
Mettez à jour vers 5.9.2
lockfile-lint-api npm
- Plages de versions concernées
- SEMVER: < 5.9.2
Mettez à jour vers 5.9.2
Sources originales
- https://security.snyk.io/vuln/SNYK-JS-LOCKFILELINTAPI-10169587
- https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151f
- https://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js%23L51-L63
- https://github.com/lirantal/lockfile-lint/pull/204
- https://github.com/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca
- https://nvd.nist.gov/vuln/detail/CVE-2025-4759