CVE-2025-45806

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-45806

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-45806.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-45806

Published

2026-04-09T00:00:00Z

Modified

2026-07-15T01:49:09.880588140Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

A cross-site scripting (XSS) vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/45xxx/CVE-2025-45806.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/rrweb-io/rrweb

Affected ranges

Type

GIT

Repo

https://github.com/rrweb-io/rrweb

Events

Introduced

Fixed

1db7a99ff32b1c826b44d82e7dda9303a49e1fb3

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "v2.0.0-alpha.18"
        }
    ],
    "source": "DESCRIPTION"
}

Affected versions

0.*

0.6.10

0.6.11

0.6.12

0.6.3

0.6.4

0.6.5

0.6.6

0.6.7

0.6.8

0.6.9

0.7.0

0.7.1

0.7.10

0.7.11

0.7.12

0.7.13

0.7.14

0.7.15

0.7.16

0.7.17

0.7.18

0.7.19

0.7.2

0.7.20

0.7.21

0.7.22

0.7.23

0.7.24

0.7.25

0.7.26

0.7.27

0.7.28

0.7.29

0.7.3

0.7.30

0.7.31

0.7.32

0.7.33

0.7.4

0.7.5

0.7.6

0.7.7

0.7.8

0.7.9

0.8.0

0.8.1

0.8.2

0.8.3

0.8.4

0.8.5

0.9.0

0.9.1

0.9.10

0.9.11

0.9.12

0.9.13

0.9.14

0.9.2

0.9.3

0.9.4

0.9.5

0.9.6

0.9.7

0.9.8

0.9.9

1.*

1.0.0

1.0.0-beta.0

1.0.0-beta.1

1.0.0-beta.2

1.0.1

1.0.2

@rrweb/all@2.*

@rrweb/all@2.0.0-alpha.15

@rrweb/all@2.0.0-alpha.17

@rrweb/packer@2.*

@rrweb/packer@2.0.0-alpha.15

@rrweb/packer@2.0.0-alpha.17

@rrweb/record@2.*

@rrweb/record@2.0.0-alpha.15

@rrweb/record@2.0.0-alpha.17

@rrweb/replay@2.*

@rrweb/replay@2.0.0-alpha.15

@rrweb/replay@2.0.0-alpha.17

@rrweb/rrweb-plugin-canvas-webrtc-record@2.*

@rrweb/rrweb-plugin-canvas-webrtc-record@2.0.0-alpha.15

@rrweb/rrweb-plugin-canvas-webrtc-record@2.0.0-alpha.17

@rrweb/rrweb-plugin-canvas-webrtc-replay@2.*

@rrweb/rrweb-plugin-canvas-webrtc-replay@2.0.0-alpha.15

@rrweb/rrweb-plugin-canvas-webrtc-replay@2.0.0-alpha.17

@rrweb/rrweb-plugin-console-record@2.*

@rrweb/rrweb-plugin-console-record@2.0.0-alpha.15

@rrweb/rrweb-plugin-console-record@2.0.0-alpha.17

@rrweb/rrweb-plugin-console-replay@2.*

@rrweb/rrweb-plugin-console-replay@2.0.0-alpha.15

@rrweb/rrweb-plugin-console-replay@2.0.0-alpha.17

@rrweb/rrweb-plugin-sequential-id-record@2.*

@rrweb/rrweb-plugin-sequential-id-record@2.0.0-alpha.15

@rrweb/rrweb-plugin-sequential-id-record@2.0.0-alpha.17

@rrweb/rrweb-plugin-sequential-id-replay@2.*

@rrweb/rrweb-plugin-sequential-id-replay@2.0.0-alpha.15

@rrweb/rrweb-plugin-sequential-id-replay@2.0.0-alpha.17

@rrweb/types@2.*

@rrweb/types@2.0.0-alpha.10

@rrweb/types@2.0.0-alpha.11

@rrweb/types@2.0.0-alpha.12

@rrweb/types@2.0.0-alpha.13

@rrweb/types@2.0.0-alpha.14

@rrweb/types@2.0.0-alpha.15

@rrweb/types@2.0.0-alpha.16

@rrweb/types@2.0.0-alpha.17

@rrweb/types@2.0.0-alpha.4

@rrweb/types@2.0.0-alpha.5

@rrweb/types@2.0.0-alpha.6

@rrweb/types@2.0.0-alpha.7

@rrweb/types@2.0.0-alpha.8

@rrweb/types@2.0.0-alpha.9

@rrweb/utils@2.*

@rrweb/utils@2.0.0-alpha.17

rrdom-nodejs@0.*

rrdom-nodejs@0.1.3

rrdom-nodejs@0.1.4

rrdom-nodejs@0.1.5

rrdom-nodejs@0.1.6

rrdom-nodejs@0.1.7

rrdom-nodejs@2.*

rrdom-nodejs@2.0.0-alpha.10

rrdom-nodejs@2.0.0-alpha.11

rrdom-nodejs@2.0.0-alpha.12

rrdom-nodejs@2.0.0-alpha.13

rrdom-nodejs@2.0.0-alpha.14

rrdom-nodejs@2.0.0-alpha.15

rrdom-nodejs@2.0.0-alpha.16

rrdom-nodejs@2.0.0-alpha.17

rrdom-nodejs@2.0.0-alpha.5

rrdom-nodejs@2.0.0-alpha.6

rrdom-nodejs@2.0.0-alpha.7

rrdom-nodejs@2.0.0-alpha.8

rrdom-nodejs@2.0.0-alpha.9

rrdom@0.*

rrdom@0.1.0

rrdom@0.1.1

rrdom@0.1.2

rrdom@0.1.3

rrdom@0.1.4

rrdom@0.1.5

rrdom@0.1.6

rrdom@0.1.7

rrdom@2.*

rrdom@2.0.0-alpha.10

rrdom@2.0.0-alpha.11

rrdom@2.0.0-alpha.12

rrdom@2.0.0-alpha.13

rrdom@2.0.0-alpha.14

rrdom@2.0.0-alpha.15

rrdom@2.0.0-alpha.16

rrdom@2.0.0-alpha.17

rrdom@2.0.0-alpha.5

rrdom@2.0.0-alpha.6

rrdom@2.0.0-alpha.7

rrdom@2.0.0-alpha.8

rrdom@2.0.0-alpha.9

rrvideo@2.*

rrvideo@2.0.0-alpha.10

rrvideo@2.0.0-alpha.11

rrvideo@2.0.0-alpha.12

rrvideo@2.0.0-alpha.13

rrvideo@2.0.0-alpha.14

rrvideo@2.0.0-alpha.15

rrvideo@2.0.0-alpha.16

rrvideo@2.0.0-alpha.17

rrvideo@2.0.0-alpha.7

rrvideo@2.0.0-alpha.8

rrvideo@2.0.0-alpha.9

rrweb-player@0.*

rrweb-player@0.7.10

rrweb-player@0.7.11

rrweb-player@0.7.12

rrweb-player@0.7.13

rrweb-player@0.7.14

rrweb-player@0.7.5

rrweb-player@0.7.6

rrweb-player@0.7.7

rrweb-player@0.7.8

rrweb-player@0.7.9

rrweb-player@1.*

rrweb-player@1.0.0-alpha.0

rrweb-player@1.0.0-alpha.1

rrweb-player@1.0.0-alpha.2

rrweb-player@1.0.0-alpha.3

rrweb-player@1.0.0-alpha.4

rrweb-player@2.*

rrweb-player@2.0.0-alpha.10

rrweb-player@2.0.0-alpha.11

rrweb-player@2.0.0-alpha.12

rrweb-player@2.0.0-alpha.13

rrweb-player@2.0.0-alpha.14

rrweb-player@2.0.0-alpha.15

rrweb-player@2.0.0-alpha.16

rrweb-player@2.0.0-alpha.17

rrweb-player@2.0.0-alpha.5

rrweb-player@2.0.0-alpha.6

rrweb-player@2.0.0-alpha.7

rrweb-player@2.0.0-alpha.8

rrweb-player@2.0.0-alpha.9

rrweb-snapshot@1.*

rrweb-snapshot@1.1.10

rrweb-snapshot@1.1.11

rrweb-snapshot@1.1.12

rrweb-snapshot@1.1.13

rrweb-snapshot@1.1.14

rrweb-snapshot@1.1.8

rrweb-snapshot@1.1.9

rrweb-snapshot@2.*

rrweb-snapshot@2.0.0-alpha.0

rrweb-snapshot@2.0.0-alpha.1

rrweb-snapshot@2.0.0-alpha.10

rrweb-snapshot@2.0.0-alpha.11

rrweb-snapshot@2.0.0-alpha.12

rrweb-snapshot@2.0.0-alpha.13

rrweb-snapshot@2.0.0-alpha.14

rrweb-snapshot@2.0.0-alpha.15

rrweb-snapshot@2.0.0-alpha.16

rrweb-snapshot@2.0.0-alpha.17

rrweb-snapshot@2.0.0-alpha.2

rrweb-snapshot@2.0.0-alpha.3

rrweb-snapshot@2.0.0-alpha.4

rrweb-snapshot@2.0.0-alpha.5

rrweb-snapshot@2.0.0-alpha.6

rrweb-snapshot@2.0.0-alpha.7

rrweb-snapshot@2.0.0-alpha.8

rrweb-snapshot@2.0.0-alpha.9

rrweb@1.*

rrweb@1.0.3

rrweb@1.0.4

rrweb@1.0.5

rrweb@1.0.6

rrweb@1.0.7

rrweb@1.0.8

rrweb@1.1.0

rrweb@1.1.1

rrweb@1.1.2

rrweb@1.1.3

rrweb@2.*

rrweb@2.0.0-alpha.0

rrweb@2.0.0-alpha.1

rrweb@2.0.0-alpha.10

rrweb@2.0.0-alpha.11

rrweb@2.0.0-alpha.12

rrweb@2.0.0-alpha.13

rrweb@2.0.0-alpha.14

rrweb@2.0.0-alpha.15

rrweb@2.0.0-alpha.16

rrweb@2.0.0-alpha.17

rrweb@2.0.0-alpha.2

rrweb@2.0.0-alpha.3

rrweb@2.0.0-alpha.4

rrweb@2.0.0-alpha.5

rrweb@2.0.0-alpha.6

rrweb@2.0.0-alpha.7

rrweb@2.0.0-alpha.8

rrweb@2.0.0-alpha.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-45806.json"