CVE-2025-58765 json
wabac.js has XSS vulnerability in 404 error handling logic
published 2025-09-09 13 mo ago modified 2026-06-17 4 mo ago also GHSA-w765-jm6w-4hhj , EUVD-2025-33982
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 17%
- public exploits
- 0
- none known
Summary
wabac.js provides a full web archive replay system, or 'wayback machine', using Service Workers. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter `requestURL` (derived from the original request target) is directly embedded into an inline `<script>` block without sanitization or escaping. This allows an attacker to craft a malicious URL that executes arbitrary JavaScript in the victim’s browser. The scope may be limited by CORS policies, depending on the situation in which wabac.js is used. The vulnerability is fixed in wabac.js v2.23.11.
Patch / fix
- npm @webrecorder/wabac 2.23.11
- npm replaywebpage 2.3.17
- npm @webrecorder/archivewebpage 0.15.4
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 13 mo ago
Exploit prediction
0.25% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
| GitHub | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @webrecorder/wabac | <2.23.11 |
2.23.11 |
| npm | replaywebpage | <2.3.17 |
2.3.17 |
| npm | @webrecorder/archivewebpage | <0.15.4 |
0.15.4 |
Affected products
- webrecorder wabac.js
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/webrecorder/wabac.js/commit/25feb4a5af69a6b65694426eae67b890be438c4c
web
-
github.com
/webrecorder/archiveweb.page/pull/315
web
-
github.com
/webrecorder/replayweb.page/pull/448
web
-
github.com
/webrecorder/wabac.js/security/advisories/GHSA-w765-jm6w-4hhj
web
-
github.com
/webrecorder/wabac.js/releases/tag/v2.23.11
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-58765
advisory
-
github.com
/webrecorder/replayweb.page/releases/tag/v2.3.17
web
-
github.com
/webrecorder/wabac.js
package
Sources
- CVE List CVE-2025-58765
- GitHub Advisory GHSA-w765-jm6w-4hhj
- NVD CVE-2025-58765
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.