CVE-2025-4759 json
lockfile-lint-api Vulnerable to Incorrect Behavior Order
published last yr. modified 4mo ago also GHSA-7cfr-5cjf-32p4 , EUVD-2025-15407
- cvss
- 8.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.
Patch / fix
- npm lockfile-lint-api 5.9.2
- n/a lockfile-lint-api 5.9.2
- github.com/lirantal/lockfile-lint@9e5305b commit
- github.com/lirantal/lockfile-lint#204 pull request
Is CVE-2025-4759 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- gist.github.com https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151f referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:P |
| CNA | 3.1 | 8.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P |
| CNA | 4.0 | 5.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 8.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 8.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | lockfile-lint-api | <5.9.2 |
5.9.2 |
Affected products
- n/a lockfile-lint-api
Classification
- Weakness
-
- CWE-179 Incorrect Behavior Order: Early Validation
References
-
github.com
/lirantal/lockfile-lint/pull/204
web, patch
-
github.com
/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca
web, patch
-
gist.github.com
/Xavier59/881aef04940970dc3e738dcbff64151f
web, exploit
-
security.snyk.io
/vuln/SNYK-JS-LOCKFILELINTAPI-10169587
web, third-party-advisory
-
github.com
/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validator
broken-link
-
nvd.nist.gov
/vuln/detail/CVE-2025-4759
advisory
-
github.com
/lirantal/lockfile-lint
package
-
github.com
/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validator
web
Sources
- CVE List CVE-2025-4759
- GitHub Advisory GHSA-7cfr-5cjf-32p4
- NVD CVE-2025-4759
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.