CVE-2025-58765

wabac.js provides a full web archive replay system, or 'wayback machine', using Service Workers. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter `requestURL` (derived from the original request target) is directly embedded into an inline `<script>` block without sanitization or escaping. This allows an attacker to craft a malicious URL that executes arbitrary JavaScript in the victim’s browser. The scope may be limited by CORS policies, depending on the situation in which wabac.js is used. The vulnerability is fixed in wabac.js v2.23.11.

• CWE-79

• https://github.com/webrecorder/wabac.js/commit/25feb4a5af69a6b65694426eae67b890be438c4c
• https://github.com/webrecorder/wabac.js/releases/tag/v2.23.11
• https://github.com/webrecorder/wabac.js/security/advisories/GHSA-w765-jm6w-4hhj

Published

Sep 9, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5876A vulnerability classified as problematic was found in Lucky…5.5
• CVE-2025-58760Tautulli is a Python based monitoring and tracking tool for …7.5
• CVE-2025-58761Tautulli is a Python based monitoring and tracking tool for …7.5
• CVE-2025-58762Tautulli is a Python based monitoring and tracking tool for …7.2
• CVE-2025-58763Tautulli is a Python based monitoring and tracking tool for …7.2
• CVE-2025-58764Claude Code is an agentic coding tool. Due to an error in co…9.8
• CVE-2025-58766Dyad is a local AI app builder. A critical security vulnerab…9
• CVE-2025-58767REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 …5.3
• CVE-2025-58768DeepChat is a smart assistant uses artificial intelligence. …9.6
• CVE-2025-58769auth0-PHP is an SDK for Auth0 Authentication and Management …3.3
• CVE-2025-5877A vulnerability, which was classified as problematic, has be…8.1
• CVE-2025-58770APTIOV contains a vulnerability in BIOS where a user may cau…8.8