cve.bz

CVE-2025-4759

5.5 mediumEPSS 0.4%

Medium (5.5) in lirantal lockfile-lint-api. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in lockfile-lint-api 5.9.2.

Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.

Severity

CVSS 4.0

5.5 medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:P

CVSS 3.1

5.3 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWE
CWE-179
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-7cfr-5cjf-32p4npmlockfile-lint-api<5.9.25.9.2

References

Check your stackJSON