CVE-2025-9288

CRITICAL EPSS 46.6%
Published Aug 20, 202510mo ago · Modified Jun 17, 20261w ago
9.1 CVSS 4.0
Critical
Find Similar
Published Aug 20, 2025 10mo ago
Last Modified Jun 17, 2026 1w ago

Description

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.

CVSS Details

Base Score
9.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
46.6% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-20 Improper Input Validation Validation

Affected Products 1

VendorProductVersionRange
browserifysha.js* ≤2.4.11

References 4

  • github.com https://github.com/browserify/sha.js/pull/78
    Issue TrackingPatch
  • github.com https://github.com/browserify/sha.js/security/advisories/GHSA-95m3-7q98-8xr5
    ExploitVendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/09/msg00016.html
  • cve.org https://www.cve.org/CVERecord?id=CVE-2025-9287
    Third Party Advisory

Remediation

  • github.com https://github.com/browserify/sha.js/pull/78
    Issue TrackingPatch