CVE-2025-4759 lockfile-lint-api Vulnerable to Incorrect Behavior Order
Attackers can bypass package validation to install unintended npm packages, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-4759?
CVE-2025-4759 is a medium-severity vulnerability in lockfile-lint-api, published on 16 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.
Weakness: CWE-179
Which versions are affected by CVE-2025-4759?
2 open source packages ship an affected version, including lockfile-lint-api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
lockfile-lint-api npm | All versions | 5.9.2 |
lockfile-lint-api npm | All versions | 5.9.2 |
Products include Lirantal Lockfile-Lint-Api.
How do I fix CVE-2025-4759?
Upgrade lockfile-lint-api to 5.9.2 or later.
Is CVE-2025-4759 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4759 exists.
Sources
Also known as GHSA-7cfr-5cjf-32p4.