CVE-2025-4759
CVE-2025-4759
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.
CVSS 6.9 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
lockfile-lint-api
- Versions
- ≥ 0, < 5.9.2: Affected (semver)
Update to 5.9.2
lockfile-lint-api npm
- Affected ranges
- SEMVER: < 5.9.2
Update to 5.9.2
Original sources
- https://security.snyk.io/vuln/SNYK-JS-LOCKFILELINTAPI-10169587
- https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151f
- https://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js%23L51-L63
- https://github.com/lirantal/lockfile-lint/pull/204
- https://github.com/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca
- https://nvd.nist.gov/vuln/detail/CVE-2025-4759