1. Home
  2. CVE Database
  3. CVE-2025-4759
HIGH · 8.3

CVE-2025-4759

Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by ex...

Vulnerability Description

Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.

CVSS Score

8.3

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
LirantalLockfile-Lint-Api< 5.9.2

Related Weaknesses (CWE)

CWE-179

References

FAQ

What is CVE-2025-4759?

CVE-2025-4759 is a vulnerability with a CVSS score of 8.3 (HIGH). Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by ex...

How severe is CVE-2025-4759?

CVE-2025-4759 has been rated HIGH with a CVSS base score of 8.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-4759?

Check the references section above for vendor advisories and patch information. Affected products include: Lirantal Lockfile-Lint-Api.