PT-2025-36995 · Prebid.Js · Prebid.Js

Patmmccann · Published 2025-09-09 · Updated 2025-09-11 · CVE-2025-59038

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Prebid.js versions prior to 10.10.0 Prebid.js version 10.9.2

Description: Prebid.js is a free and open source library used by publishers to implement header bidding. NPM users of version 10.9.2 may have been compromised by a malware campaign that attempts to redirect cryptocurrency transactions on the site to the attackers' wallet.

Recommendations: Upgrade to Prebid.js version 10.10.0. Downgrade to Prebid.js version 10.9.1.

Exploit

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

CVE-2025-59038

GHSA-JWQ7-6J4R-2F92

MAL-2025-46990

Affected Products

Prebid.Js

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59038.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59038 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59038 · Vendor Advisory
• https://osv.dev/vulnerability/MAL-2025-46990 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jwq7-6j4r-2f92 · Vendor Advisory
• https://github.com/prebid/Prebid.js/security/advisories/GHSA-jwq7-6j4r-2f92 · Note
• https://github.com/prebid/Prebid.js · Note
• https://github.com/prebid/Prebid.js/releases/tag/10.10.0 · Note
• https://github.com/prebid/Prebid.js/commit/72c7f184028f51ba15cdac744d56590b0f2b1f1e · Note
• https://github.com/advisories/GHSA-4hjx-fhh8-vr6j · Note
• https://bleepingcomputer.com/news/security/hackers-hijack-npm-packages-with-2-billion-weekly-downloads-in-supply-chain-attack · Note
• https://twitter.com/offseq/status/1965618905684046048 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1965597139314057393 · Twitter Post
• https://github.com/advisories/GHSA-jwq7-6j4r-2f92 · Note
• https://aikido.dev/blog/npm-debug-and-chalk-packages-compromised · Note