PT-2025-17316 · Ses · Ses

Mingijunggrape · Published 2025-04-18 · Updated 2025-04-22 · CVE-2025-32792

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SES versions prior to 1.12.0

Description The issue arises when using the SES and Compartment API to evaluate third-party code in an isolated environment. In versions prior to 1.12.0, top-level let, const, and class bindings in <script> tags are inadvertently revealed in the lexical scope of third-party code. This is due to the way these bindings are handled in the global scope.

Recommendations For versions prior to 1.12.0, consider updating to version 1.12.0 to resolve the issue. As a temporary workaround, avoid using top-level let, const, or class bindings in <script> tags. Alternatively, change top-level let, const, or class bindings to var bindings to prevent them from being reflected on globalThis.

Exploit

Fix

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2025-32792

GHSA-H9W6-F932-GQ62

Affected Products

Ses

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32792.json · Exploit
• https://osv.dev/vulnerability/GHSA-h9w6-f932-gq62 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32792 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32792 · Vendor Advisory
• https://github.com/endojs/endo/security/advisories/GHSA-h9w6-f932-gq62 · Note
• https://github.com/endojs/endo · Note
• https://twitter.com/CVEnew/status/1913312928977264849 · Twitter Post
• https://t.me/cvedetector/23313 · Telegram Post
• https://t.me/cvetracker/21936 · Telegram Post
• https://t.me/latest_high_impact_cve/2160 · Telegram Post
• https://twitter.com/CveFindCom/status/1914584320993374402 · Twitter Post