CVE-2025-4759

Description

Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.

CVSS v3.1 Score

8.3

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Weakness Type (CWE)

CWE-179 CWE-179

Affected Products

Vendor	Product	Versions
lirantal	lockfile-lint-api	< 5.9.2

References

Advisories & Patches

https://github.com/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca https://github.com/lirantal/lockfile-lint/pull/204

Exploits

https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151f

Other References

https://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js%23L51-L63 https://security.snyk.io/vuln/SNYK-JS-LOCKFILELINTAPI-10169587

Frequently Asked Questions

What is CVE-2025-4759? +

Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one. It has a CVSS v3.1 base score of 8.3 (HIGH).

How severe is CVE-2025-4759? +

CVE-2025-4759 has a CVSS v3.1 score of 8.3 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-4759? +

CVE-2025-4759 affects products from lirantal, specifically: lockfile-lint-api. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-4759? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-49414 7.8

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base …

CVE-2026-3832 3.7

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate …

CVE-2024-41686 3.3

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to improper implementation of password policies. A local attacker could exploit this …