Skip to content
Heist/ feed
Back to feed
Medium

Security advisory

Type: advisorySources: OSVCVE: CVE-2025-4759

Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-4759
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 02:05 UTC · Revision 1

Source evidence

CVE-2025-4759

core-osv · Original source

Published 16 May 2025, 05:00 UTC

Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.

osv:CVE-2025-4759
Complete source record
{
  "id": "301ef71a42fb8d44896f2ec30da74445746b2ce2204dc5eb855673b32dd189a3",
  "url": "https://osv.dev/vulnerability/CVE-2025-4759",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2025-4759",
    "summary": "Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.",
    "evidence": "osv:CVE-2025-4759",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2025-4759",
      "aliases": [
        "CVE-2025-4759",
        "GHSA-7cfr-5cjf-32p4"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:P"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/lirantal/lockfile-lint",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "b3a5d0d640d47968ba3bf154179cbcf1e82a6cf6"
                },
                {
                  "fixed": "9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:lirantal:lockfile-lint-api:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "5.9.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "lockfile-lint@4.14.0",
            "lockfile-lint@4.13.2",
            "lockfile-lint@4.13.1",
            "lockfile-lint-api@5.9.1",
            "lockfile-lint@4.13.0",
            "lockfile-lint-api@5.9.0",
            "lockfile-lint@4.12.1",
            "lockfile-lint@4.12.0",
            "lockfile-lint@4.11.0",
            "lockfile-lint-api@5.8.0",
            "lockfile-lint-api@5.7.0",
            "lockfile-lint-api@5.6.0",
            "lockfile-lint@4.10.6",
            "lockfile-lint@4.10.5",
            "lockfile-lint-api@5.5.5",
            "lockfile-lint@4.10.4",
            "lockfile-lint-api@5.5.4",
            "lockfile-lint@4.10.3",
            "lockfile-lint-api@5.5.3",
            "lockfile-lint@4.10.2",
            "lockfile-lint-api@5.5.2",
            "lockfile-lint@4.10.1",
            "lockfile-lint-api@5.5.1",
            "lockfile-lint@4.10.0",
            "lockfile-lint-api@5.5.0",
            "lockfile-lint@4.9.6",
            "lockfile-lint-api@5.4.6",
            "lockfile-lint@4.9.5",
            "lockfile-lint-api@5.4.5",
            "lockfile-lint@4.9.4",
            "lockfile-lint-api@5.4.4",
            "lockfile-lint@4.9.3",
            "lockfile-lint-api@5.4.3",
            "lockfile-lint@4.9.2",
            "lockfile-lint-api@5.4.2",
            "lockfile-lint@4.9.1",
            "lockfile-lint-api@5.4.1",
            "lockfile-lint@4.9.0",
            "lockfile-lint-api@5.4.0",
            "lockfile-lint@4.8.0",
            "lockfile-lint-api@5.3.0",
            "lockfile-lint@4.7.7",
            "lockfile-lint-api@5.2.7",
            "lockfile-lint@4.7.6",
            "lockfile-lint-api@5.2.6",
            "lockfile-lint@4.7.5",
            "lockfile-lint-api@5.2.5",
            "lockfile-lint@4.7.4",
            "lockfile-lint-api@5.2.4",
            "lockfile-lint@4.7.3",
            "lockfile-lint-api@5.2.3",
            "lockfile-lint@4.7.2",
            "lockfile-lint-api@5.2.2",
            "lockfile-lint@4.7.1",
            "lockfile-lint-api@5.2.1",
            "lockfile-lint@4.6.3",
            "lockfile-lint-api@5.1.8",
            "lockfile-lint@4.6.2",
            "lockfile-lint-api@5.1.7",
            "lockfile-lint@4.6.1",
            "lockfile-lint@4.6.0",
            "lockfile-lint@4.3.8",
            "lockfile-lint@4.3.7",
            "lockfile-lint@4.3.6",
            "lockfile-lint@4.3.5",
            "lockfile-lint@4.3.4",
            "lockfile-lint-api@5.1.6",
            "lockfile-lint@4.3.3",
            "lockfile-lint-api@5.1.5",
            "lockfile-lint@4.3.1",
            "lockfile-lint@4.2.2",
            "lockfile-lint-api@5.1.2",
            "lockfile-lint@4.2.1",
            "lockfile-lint-api@5.1.1",
            "lockfile-lint@4.2.0",
            "lockfile-lint-api@5.1.0",
            "lockfile-lint@4.1.0",
            "lockfile-lint@4.0.0",
            "lockfile-lint@3.0.18",
            "lockfile-lint@3.0.17",
            "lockfile-lint@3.0.16",
            "lockfile-lint-api@5.0.12",
            "lockfile-lint@3.0.15",
            "lockfile-lint-api@5.0.11",
            "lockfile-lint@3.0.14",
            "lockfile-lint@3.0.13",
            "lockfile-lint@3.0.12",
            "lockfile-lint-api@5.0.10",
            "lockfile-lint@3.0.11",
            "lockfile-lint-api@5.0.9",
            "lockfile-lint@3.0.10",
            "lockfile-lint-api@5.0.8",
            "lockfile-lint@3.0.9",
            "lockfile-lint@3.0.8",
            "lockfile-lint-api@5.0.7",
            "lockfile-lint@3.0.7",
            "lockfile-lint-api@5.0.6",
            "lockfile-lint@3.0.6",
            "lockfile-lint-api@5.0.5",
            "lockfile-lint@3.0.5",
            "lockfile-lint-api@5.0.4",
            "lockfile-lint@3.0.4",
            "lockfile-lint-api@5.0.3",
            "lockfile-lint@3.0.3",
            "lockfile-lint-api@5.0.2",
            "lockfile-lint@3.0.2",
            "lockfile-lint-api@5.0.1",
            "lockfile-lint@3.0.1",
            "lockfile-lint-api@5.0.0",
            "lockfile-lint@3.0.0",
            "lockfile-lint@2.2.0",
            "lockfile-lint-api@2.3.0",
            "lockfile-lint@2.1.6",
            "lockfile-lint-api@2.2.0",
            "lockfile-lint@2.1.5",
            "lockfile-lint-api@2.1.4",
            "lockfile-lint@2.1.4",
            "lockfile-lint-api@2.1.3",
            "lockfile-lint@2.1.3",
            "lockfile-lint-api@2.1.2",
            "lockfile-lint@2.1.2",
            "lockfile-lint-api@2.1.1",
            "lockfile-lint@2.1.1",
            "lockfile-lint@2.1.0",
            "lockfile-lint-api@2.1.0",
            "lockfile-lint@2.0.1",
            "lockfile-lint@2.0.0",
            "lockfile-lint-api@2.0.0",
            "lockfile-lint@1.3.4",
            "lockfile-lint-api@1.0.7",
            "lockfile-lint@1.3.0",
            "lockfile-lint-api@1.0.4",
            "lockfile-lint-api@1.0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4759.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:52.886188920Z",
      "provider": "osv",
      "references": [
        "https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151f",
        "https://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js%23L51-L63",
        "https://security.snyk.io/vuln/SNYK-JS-LOCKFILELINTAPI-10169587",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4759.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-4759",
        "https://github.com/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca",
        "https://github.com/lirantal/lockfile-lint/pull/204"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-179"
        ],
        "cna_assigner": "snyk",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4759.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-4759",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 521618,
  "published_at": "2025-05-16T05:00:04.621+00:00"
}