CVE-2025-32965 Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2
Malicious code in compromised xrpl.js versions exfiltrates private keys, requiring immediate upgrade and key rotation to prevent account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-32965?
CVE-2025-32965 is a critical vulnerability in XRPLF xrpl.js, published on 22 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also malicious, though it is less likely to lead to exploitation as it is not compatible with other 2.x versions. Anyone who used one of these versions should stop immediately and rotate any private keys or secrets used with affected systems. Users of xrpl.js should pgrade to version 4.2.5 or 2.14.3 to receive a patch. To secure funds, think carefully about whether any keys may have been compromised by this supply chain attack, and mitigate by sending funds to secure wallets, and/or rotating keys. If any account's master key is potentially compromised, disable the key.
Weakness: CWE-506
Which versions are affected by CVE-2025-32965?
4 open source packages ship an affected version, including xrpl.
| Package | Affected | Fixed in |
|---|---|---|
xrpl npm | From 2.14.2 | 2.14.3 |
xrpl npm | From 2.14.2 | 2.14.3 |
xrpl npm | From 4.2.1 | 4.2.5 |
xrpl npm | From 4.2.1 | 4.2.5 |
How do I fix CVE-2025-32965?
Upgrade xrpl to a fixed version for your release line: 2.14.3 or 4.2.5.
Is CVE-2025-32965 being exploited?
There is no known exploitation of CVE-2025-32965 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-33qr-m49q-rxfx.