How severe is CVE-2025-4759?

CVE-2025-4759 has a CVSS 3.x base score of 8.3, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2025-4759 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-4759?

CVE-2025-4759 affects Lirantal Lockfile-lint-api. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-4759?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-4759 have an EU (EUVD) identifier?

Yes. CVE-2025-4759 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-15407.

When was CVE-2025-4759 published?

CVE-2025-4759 was published on 2025-05-16 and last updated on 2026-06-17.

CVE-2025-4759

CVE-2025-4759 is a high-severity vulnerability in Lirantal Lockfile-lint-api with a CVSS 3.x base score of 8.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-179.

Key facts

Severity: High (CVSS 3.x base score 8.3)
CVSS v4: 5.5
EPSS exploit prediction: 0% (27th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-15407
Weakness: CWE-179
Affected product: Lirantal Lockfile-lint-api
Published: 2025-05-16
Last modified: 2026-06-17

Description

Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.

Frequently asked questions

What is CVE-2025-4759?: Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.
How severe is CVE-2025-4759?: CVE-2025-4759 has a CVSS 3.x base score of 8.3, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2025-4759 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-4759?: CVE-2025-4759 affects Lirantal Lockfile-lint-api. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-4759?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-4759 have an EU (EUVD) identifier?: Yes. CVE-2025-4759 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-15407.
When was CVE-2025-4759 published?: CVE-2025-4759 was published on 2025-05-16 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:lirantal:lockfile-lint-api:*:*:*:*:*:node.js:*:*

Other CWE-179 vulnerabilities

CVE-2026-49414 — High (CVSS 7.8): The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the…
CVE-2026-3832 — Low (CVSS 3.7): A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online…
CVE-2024-41686 — Low (CVSS 3.3): This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to improper implementation of password policies. A…

Browse all CWE-179 vulnerabilities →