GHSA-w765-jm6w-4hhj

Webrecorder packages are vulnerable to XSS through 404 error handling logic

Source: GitHub Advisory Database (reviewed) High CVE-2025-58765

Packages

Ecosystem	Package	Affected	Fixed in
npm	@webrecorder/wabac	< 2.23.11	2.23.11
npm	replaywebpage	< 2.3.17	2.3.17
npm	@webrecorder/archivewebpage	< 0.15.4	0.15.4

Details

As written in the advisory (Markdown source, shown as plain text).

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter `requestURL` (derived from the original request target) is directly embedded into an inline `<script>` block without sanitization or escaping. This allows an attacker to craft a malicious URL that executes arbitrary JavaScript in the victim’s browser. The scope may be limited by CORS policies, depending on the situation in which wabac.js is used. ### Patches The vulnerability is fixed in wabac.js v2.23.11.

References

External links from the advisory. They lead to third-party sites.