GitHub Advisoryadvisory · npm

GHSA-xq7p-g2vc-g82p Homograph attack allows Unicode lookalike characters to bypass validation.

HIGH Published 2025-04-30 Modified 2025-05-01 Official page ↗

Aliases: CVE-2025-27611
Ecosystem: npm
Packages: base-x
Severity: High
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses: CWE-1007
Reviewed: 2025-04-30

Affected packages

• npm base-x: >= 5.0.0, < 5.0.1 → fixed in 5.0.1 • npm base-x: >= 4.0.0, < 4.0.1 → fixed in 4.0.1 • npm base-x: < 3.0.11 → fixed in 3.0.11

Description

Impact Attackers can deceive users into sending funds to an unintended address. Patches https://github.com/cryptocoinjs/base-x/pull/86

Related

Alias · CVE (1)

CVE-2025-27611 base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. vulnerability

Weakness · CWE (1)

CWE-1007 Insufficient Visual Distinction of Homoglyphs Presented to User weakness

References