CVE-2025-66402
CVE-2025-66402 · misskey.js's export data contains private post data
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permission to view favorites or clips can can export the posts and view the contents. Version 2025.12.0 fixes the issue.
CVSS 7.1 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
misskey
- Versions
- >= 13.0.0-beta.16, < 2025.12.0: Affected
No fix published
misskey-js npm
- Affected ranges
- SEMVER: ≥ 13.0.0-beta.16, < 2025.12.0
Update to 2025.12.0