CVE-2025-45525
lowPriorität · verfolgen · 0EPSS 0.001 · 4. PerzentilEUUSEPSS · bewertet 2026-10-27
A NULL pointer dereference vulnerability has been identified in the JavaScript library microlight version 0.0.7, a lightweight syntax highlighting library. When processing elements with non-standard CSS color values, the library fails to validate the result of a regular expression match before accessing its properties, leading to an uncaught TypeError and potential application crash. NOTE: this is disputed by multiple parties because there is no common scenario in which an adversary can insert those non-standard values.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (3)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-64x7-m7rh-9m83Withdrawn Advisory: microlight.js has a null pointer dereference vulnerability2025-06-17ghsa · osvUS
## Withdrawn Advisory This advisory has been withdrawn because a website owner has to set CSS color values. The proof of concept doesn't demonstrate how a malicious user who is not the website owner can cause an application crash. This link has been maintained to preserve external references. ## Original Description A null pointer dereference vulnerability was discovered in microlight.js (version 0.0.7), a lightweight syntax highlighting library. When processing elements with non-standard CSS color values, the library fails to validate the result of a regular expression match before accessing its properties, leading to an uncaught TypeError and potential application crash.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (8)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2025-45525cnnvd
- https://gist.github.com/Rootingg/843368931f70886bed3cf982f10a4424cnnvd
- https://github.com/github/advisory-database/pull/5730cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2025-45525cnnvd
- https://gist.github.com/Rootingg/843368931f70886bed3cf982f10a4424enisa_euvd
- https://github.com/github/advisory-database/pull/5730enisa_euvd
- https://gist.github.com/Rootingg/843368931f70886bed3cf982f10a4424nvd
- https://github.com/github/advisory-database/pull/5730nvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan