CVE-2025-32792

SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0, web pages and web extensions using `ses` and the Compartment API to evaluate third-party code in an isolated execution environment that have also elsewhere used `const`, `let`, and `class` bindings in the top-level scope of a `<script>` tag will have inadvertently revealed these bindings in the lexical scope of third-party code. This issue has been patched in version 1.12.0. Workarounds for this issue involve either avoiding top-level `let`, `const`, or `class` bindings in `<script>` tags, or change these to `var` bindings to be reflected on `globalThis`.

• CWE-497

• https://github.com/endojs/endo/security/advisories/GHSA-h9w6-f932-gq62

Published

Apr 18, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32787SoftEtherVPN is a an open-source cross-platform multi-protoc…3.1
• CVE-2025-32788OctoPrint provides a web interface for controlling consumer …4.3
• CVE-2025-32789EspoCRM is an Open Source Customer Relationship Management s…3.7
• CVE-2025-3279An issue has been discovered in GitLab CE/EE affecting all v…6.5
• CVE-2025-32790Dify is an open-source LLM app development platform. In vers…4.3
• CVE-2025-32791The Backstage Scaffolder plugin houses types and utilities f…4.3
• CVE-2025-32793Cilium is a networking, observability, and security solution…4
• CVE-2025-32794OpenEMR is a free and open source electronic health records …7.6
• CVE-2025-32795Dify is an open-source LLM app development platform. Prior t…6.5
• CVE-2025-32796Dify is an open-source LLM app development platform. Prior t…6.5
• CVE-2025-32797Conda-build contains commands and tools to build conda packa…7
• CVE-2025-32798Conda-build contains commands and tools to build conda packa…9.8