CVE-2025-58765

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-58765
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58765.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-58765
Aliases
Published
2025-09-09T20:16:26.657Z
Modified
2026-04-10T05:33:01.208595Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CVSS Calculator
Summary
wabac.js has XSS vulnerability in 404 error handling logic
Details

wabac.js provides a full web archive replay system, or 'wayback machine', using Service Workers. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter requestURL (derived from the original request target) is directly embedded into an inline <script> block without sanitization or escaping. This allows an attacker to craft a malicious URL that executes arbitrary JavaScript in the victim’s browser. The scope may be limited by CORS policies, depending on the situation in which wabac.js is used. The vulnerability is fixed in wabac.js v2.23.11.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58765.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/webrecorder/wabac.js

Affected ranges

Type
GIT
Repo
https://github.com/webrecorder/wabac.js
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
25feb4a5af69a6b65694426eae67b890be438c4c
Type
GIT
Repo
https://github.com/webrecorder/wabac.js
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0c59ee0081c8327adb23309c22668554339ab741

Affected versions

2.*
2.12.0
2.13.15
2.14.0
v.*
v.2.15.5
v2.*
v2.14.1
v2.15.0
v2.15.2
v2.15.3
v2.15.4
v2.16.0
v2.16.1
v2.16.10
v2.16.11
v2.16.12
v2.16.13
v2.16.2
v2.16.3
v2.16.4
v2.16.5
v2.16.6
v2.16.7
v2.16.8
v2.16.9
v2.17.0
v2.17.1
v2.17.2
v2.17.3
v2.18.0
v2.18.1
v2.18.2
v2.18.3
v2.18.4
v2.19.0
v2.19.1
v2.19.2
v2.19.3
v2.19.4
v2.19.5
v2.19.6
v2.19.7
v2.19.8
v2.19.9
v2.20.0
v2.20.1
v2.20.2
v2.20.3
v2.20.4
v2.20.5
v2.20.6
v2.20.7
v2.20.8
v2.21.0
v2.21.1
v2.21.2
v2.21.3
v2.21.4
v2.22.0
v2.22.0-beta.0
v2.22.1
v2.22.10
v2.22.11
v2.22.12
v2.22.13
v2.22.14
v2.22.15
v2.22.16
v2.22.17
v2.22.2
v2.22.3
v2.22.4
v2.22.5
v2.22.6
v2.22.7
v2.22.8
v2.22.9
v2.23.0
v2.23.1
v2.23.10
v2.23.2
v2.23.3
v2.23.4
v2.23.5
v2.23.6
v2.23.7
v2.23.8
v2.23.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58765.json"