PT-2026-4771 · Eslint · Eslint

Published 2025-01-01 · Updated 2026-02-04 · CVE-2025-50537

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions eslint versions prior to 9.26.0

Description A stack overflow issue exists in eslint when serializing objects containing circular references within the eslint/lib/shared/serialization.js file. The issue is triggered through the RuleTester.run() method, which is used to validate test cases and identify duplicates. The checkDuplicateTestCase() function calls isSerializable(), which enters infinite recursion when handling circular reference objects, leading to a stack overflow.

Recommendations Update to version 9.26.0 or later.

Exploit

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2025-50537

GHSA-P5WG-G6QR-C7CG

Affected Products

Eslint

References · 16

• 🔥 https://github.com/eslint/eslint/issues/19646 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-50537 · Security Note
• https://ubuntu.com/security/CVE-2025-50537 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-50537 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p5wg-g6qr-c7cg · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-50537 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-50537 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-50537 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-50537 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-50537 · Vendor Advisory
• https://github.com/eslint/eslint/commit/d683aebc8e0792e4f80bd1488c705c90f22c317e · Note
• https://github.com/eslint/eslint · Note
• https://twitter.com/CVEnew/status/2015815285547110546 · Twitter Post
• https://gist.github.com/lyyffee/2ee1815e5c2da82c05e9838b9bfefbbc · Note
• https://twitter.com/VulmonFeeds/status/2015826156105117744 · Twitter Post