high7.1
CVE-2025-58765
Webrecorder packages are vulnerable to XSS through 404 error handling logic
Impact
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter `requestURL` (derived from the original request target) is directly embedded into an inline `<script>` block without sanitization or escaping. This allows an attacker to craft a malicious URL that executes arbitrary JavaScript in the victim’s browser. The scope may be limited by CORS policies, depending on the situation in which wabac.js is used. ### Patches The vulnerability is fixed in wabac.js v2.23.11.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @webrecorder/wabac | < 2.23.11 | 2.23.11 |
| npm | replaywebpage | < 2.3.17 | 2.3.17 |
| npm | @webrecorder/archivewebpage | < 0.15.4 | 0.15.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/webrecorder/wabac.js/commit/25feb4a5af69a6b65694426eae67b890be438c4c
- https://github.com/webrecorder/wabac.js/releases/tag/v2.23.11
- https://github.com/webrecorder/wabac.js/security/advisories/GHSA-w765-jm6w-4hhj
- https://github.com/advisories/GHSA-w765-jm6w-4hhj
- https://nvd.nist.gov/vuln/detail/CVE-2025-58765
- https://github.com/webrecorder/archiveweb.page/pull/315
- https://github.com/webrecorder/replayweb.page/pull/448
- https://github.com/webrecorder/replayweb.page/releases/tag/v2.3.17