CVE-2025-32792
CVE-2025-32792 is a high-severity vulnerability with a CVSS 4.0 base score of 8.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-497.
Key facts
- Severity: High (CVSS 4.0 base score 8.7)
- EPSS exploit prediction: 0% (36th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-11857
- Weakness: CWE-497
- Published:
- Last modified:
Description
SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0, web pages and web extensions using `ses` and the Compartment API to evaluate third-party code in an isolated execution environment that have also elsewhere used `const`, `let`, and `class` bindings in the top-level scope of a `<script>` tag will have inadvertently revealed these bindings in the lexical scope of third-party code. This issue has been patched in version 1.12.0. Workarounds for this issue involve either avoiding top-level `let`, `const`, or `class` bindings in `<script>` tags, or change these to `var` bindings to be reflected on `globalThis`.
Frequently asked questions
- What is CVE-2025-32792?
- SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0, web pages and web extensions using `ses` and the Compartment API to evaluate third-party code in an isolated execution environment that have also elsewhere used `const`, `let`, and `class` bindings in the top-level scope of a `<script>` tag will have inadvertently revealed these bindings in the lexical scope of third-party code. This issue has been patched in version 1.12.0. Workarounds for this issue involve either avoiding top-level `let`, `const`, or `class` bindings in `<script>` tags, or change these to `var` bindings to be reflected on `globalThis`.
- How severe is CVE-2025-32792?
- CVE-2025-32792 has a CVSS 4.0 base score of 8.7, rated high severity.
- Is CVE-2025-32792 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2025-32792?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2025-32792 have an EU (EUVD) identifier?
- Yes. CVE-2025-32792 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-11857.
- When was CVE-2025-32792 published?
- CVE-2025-32792 was published on 2025-04-18 and last updated on 2026-06-17.
References
Other CWE-497 vulnerabilities
- CVE-2025-10264 — Critical (CVSS 10.0): Certain models of NVR developed by Digiever has an Exposure of Sensitive Information vulnerability, allowing…
- CVE-2026-27494 — Critical (CVSS 9.9): n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated…
- CVE-2025-47699 — Critical (CVSS 9.9): Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho…
- CVE-2025-44823 — Critical (CVSS 9.9): Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a…
- CVE-2026-14808 — Critical (CVSS 9.8): Prog Management System developed by PROG MIS has a Exposure of Sensitive Information vulnerability, allowing…
- CVE-2024-13999 — Critical (CVSS 9.8): Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or…