GitHub Advisoryadvisory · npm

GHSA-7cfr-5cjf-32p4 lockfile-lint-api Vulnerable to Incorrect Behavior Order

MEDIUM Published 2025-05-16 Modified 2025-05-16 Official page ↗
Aliases
CVE-2025-4759
Ecosystem
npm
Packages
lockfile-lint-api
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Weaknesses
CWE-179
Reviewed
2025-05-16

Affected packages

• npm lockfile-lint-api: < 5.9.2 → fixed in 5.9.2

Description

Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.

Related

Alias · CVE (1)

  • CVE-2025-4759 Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved… vulnerability

Weakness · CWE (1)

  • CWE-179 Incorrect Behavior Order: Early Validation weakness

References