PT-2025-21607 · Npm · Lockfile-Lint-Api

Xavier Bruni · Published 2025-05-16 · Updated 2025-06-03 · CVE-2025-4759

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: lockfile-lint-api versions prior to 5.9.2

Description: The issue concerns incorrect behavior order, specifically early validation, via the resolved attribute of the package URL validation. This can be bypassed by extending the package name, allowing an attacker to install other npm packages than the intended one.

Recommendations: For versions prior to 5.9.2, update to version 5.9.2 or later to resolve the issue. As a temporary workaround, consider restricting package installations to only those that are explicitly intended, to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-179

Related Identifiers

CVE-2025-4759

GHSA-7CFR-5CJF-32P4

Affected Products

Lockfile-Lint-Api

References · 16

• 🔥 https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151f · Exploit
• https://github.com/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca · Patch
• https://github.com/lirantal/lockfile-lint/pull/204 · Patch
• https://osv.dev/vulnerability/GHSA-7cfr-5cjf-32p4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-4759 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4759 · Security Note
• https://github.com/lirantal/lockfile-lint · Note
• https://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js%23L51-L63 · Note
• https://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js#L51-L63 · Note
• https://t.me/cvenotify/122482 · Telegram Post
• https://twitter.com/dailycve/status/1929958154948796875 · Twitter Post
• https://twitter.com/cracbot/status/1925144602841080281 · Twitter Post
• https://twitter.com/CVEnew/status/1923600427523678232 · Twitter Post
• https://t.me/cvetracker/23990 · Telegram Post
• https://t.me/latest_high_impact_cve/2379 · Telegram Post