{"cve":"CVE-2025-58765","nvd":{"published":"2025-09-09T21:15:38.763","modified":"2026-06-17T09:44:53.997","status":"Deferred","description":"wabac.js provides a full web archive replay system, or 'wayback machine', using Service Workers. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter `requestURL` (derived from the original request target) is directly embedded into an inline `<script>` block without sanitization or escaping. This allows an attacker to craft a malicious URL that executes arbitrary JavaScript in the victim’s browser. The scope may be limited by CORS policies, depending on the situation in which wabac.js is used. The vulnerability is fixed in wabac.js v2.23.11.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","score":7.1},"cwes":["CWE-79"],"references":["https://github.com/webrecorder/wabac.js/commit/25feb4a5af69a6b65694426eae67b890be438c4c","https://github.com/webrecorder/wabac.js/releases/tag/v2.23.11","https://github.com/webrecorder/wabac.js/security/advisories/GHSA-w765-jm6w-4hhj"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:08:41.295252406+00:00"},"epss":{"cve":"CVE-2025-58765","score":0.00254,"percentile":0.16962,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-w765-jm6w-4hhj","url":"https://osv.dev/vulnerability/GHSA-w765-jm6w-4hhj","summary":"Webrecorder packages are vulnerable to XSS through 404 error handling logic","modified":"2025-09-10T17:13:45Z","packages":[{"ecosystem":"npm","name":"@webrecorder/wabac","purl":"pkg:npm/%40webrecorder/wabac","ranges":["<2.23.11"],"fixed":["2.23.11"]},{"ecosystem":"npm","name":"replaywebpage","purl":"pkg:npm/replaywebpage","ranges":["<2.3.17"],"fixed":["2.3.17"]},{"ecosystem":"npm","name":"@webrecorder/archivewebpage","purl":"pkg:npm/%40webrecorder/archivewebpage","ranges":["<0.15.4"],"fixed":["0.15.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}