CVE-2025-9287

CRITICAL EPSS 37.2%
Published Aug 20, 202510mo ago · Modified Jun 17, 20261w ago
9.1 CVSS 4.0
Critical
Find Similar
Published Aug 20, 2025 10mo ago
Last Modified Jun 17, 2026 1w ago

Description

Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.

CVSS Details

Base Score
9.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
37.2% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-20 Improper Input Validation Validation

Affected Products 1

VendorProductVersionRange
browserifycipher-base* ≤1.0.4

References 3

  • github.com https://github.com/browserify/cipher-base/pull/23
    Issue TrackingPatch
  • github.com https://github.com/browserify/cipher-base/security/advisories/GHSA-cpq7-6gpm-g9rc
    ExploitVendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/09/msg00005.html

Remediation

  • github.com https://github.com/browserify/cipher-base/pull/23
    Issue TrackingPatch