wabac.js has XSS vulnerability in 404 error handling logic
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
wabac.js provides a full web archive replay system, or 'wayback machine', using Service Workers. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter `requestURL` (derived from the original request target) is directly embedded into an inline `<script>` block without sanitization or escaping. This allows an attacker to craft a malicious URL that executes arbitrary JavaScript in the victim’s browser. The scope may be limited by CORS policies, depending on the situation in which wabac.js is used. The vulnerability is fixed in wabac.js v2.23.11.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| webrecorder | wabac.js | before 2.23.11 | 2.23.11 | Patch available | CNA |
| — | @webrecorder/wabac (npm) | before 2.23.11 | 2.23.11 | Patch available | GHSA-w765-jm6w-4hhj |
| — | replaywebpage (npm) | before 2.3.17 | 2.3.17 | Patch available | GHSA-w765-jm6w-4hhj |
| — | @webrecorder/archivewebpage (npm) | before 0.15.4 | 0.15.4 | Patch available | GHSA-w765-jm6w-4hhj |
- wabac.js Vendorwebrecorder Affected before 2.23.11 Fixed in 2.23.11 Patch available CNA
- @webrecorder/wabac (npm) Vendor— Affected before 2.23.11 Fixed in 2.23.11 Patch available GHSA-w765-jm6w-4hhj
- replaywebpage (npm) Vendor— Affected before 2.3.17 Fixed in 2.3.17 Patch available GHSA-w765-jm6w-4hhj
- @webrecorder/archivewebpage (npm) Vendor— Affected before 0.15.4 Fixed in 0.15.4 Patch available GHSA-w765-jm6w-4hhj
Remediation
- Fix · CNA wabac.js (webrecorder) Fixed in 2.23.11
- Fix · GHSA-w765-jm6w-4hhj @webrecorder/wabac (npm) Fixed in 2.23.11 Advisory →
- Fix · GHSA-w765-jm6w-4hhj replaywebpage (npm) Fixed in 2.3.17 Advisory →
- Fix · GHSA-w765-jm6w-4hhj @webrecorder/archivewebpage (npm) Fixed in 0.15.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-58765
- 2026-10-03 Alias added: GHSA-w765-jm6w-4hhj
References
Other 7
- https://github.com/webrecorder/wabac.js/security/advisories/GHSA-w765-jm6w-4hhj
- https://github.com/webrecorder/wabac.js/commit/25feb4a5af69a6b65694426eae67b890be438c4c
- https://github.com/webrecorder/wabac.js/releases/tag/v2.23.11
- https://github.com/webrecorder/archiveweb.page/pull/315
- https://github.com/webrecorder/replayweb.page/pull/448
- https://github.com/webrecorder/replayweb.page/releases/tag/v2.3.17
- https://github.com/webrecorder/wabac.js
More webrecorder vulnerabilities
- TI-2026-39347 Browsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviors CVSS 4.0CRITICAL 9.4
- TI-2021-16663 Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped. CVSS 3.1MEDIUM 6.1
Sources
- CVE-2025-58765 · CVE Program
- CVE-2025-58765 · NVD
- FIRST EPSS
- GHSA-w765-jm6w-4hhj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences