PT-2025-36996 · Prebid.Js+1 · Prebid.Js+1

Patmmccann · Published 2025-09-09 · Updated 2025-09-11 · CVE-2025-59039

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Prebid Universal Creative (PUC) versions 1.17.3 and latest

Description: Prebid Universal Creative (PUC) is a JavaScript API used to render multiple formats. Npm users of PUC were briefly affected by crypto-related malware.

Recommendations: Transition to PUC version 1.17.2 to avoid similar attacks. See Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using PUC or pointing to a dynamic version of it.

Exploit

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

CVE-2025-59039

GHSA-M662-56RJ-8FMM

Affected Products

Prebid-Universal-Creative

Prebid.Js

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59039.json · Exploit
• https://osv.dev/vulnerability/GHSA-m662-56rj-8fmm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59039 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59039 · Vendor Advisory
• https://github.com/prebid/prebid-universal-creative/security/advisories/GHSA-m662-56rj-8fmm · Note
• https://github.com/prebid/prebid-universal-creative · Note
• https://twitter.com/CVEnew/status/1965557671366479898 · Twitter Post
• https://sonatype.com/blog/npm-chalk-and-debug-packages-hit-in-software-supply-chain-attack · Note