CVE-2025-9288

🗓️ 20 Aug 2025 21:59:44Reported by harboristType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 68 Views

CVE-2025-9288: Improper input validation in sha.js allows data manipulation; affects up to 2.4.11.

Reporter	Title	Published	Views	Family All 67
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in sha.js-2.4.11.tgz CVE-2025-9288	22 Oct 202511:24	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to improper input validation due to the sha.js package (CVE-2025-9288)	28 Nov 202519:02	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of the sha.js library, IBM watsonx Code Assistant IDE Extensions is affected by Improper Input Validation vulnerability	19 Nov 202515:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	28 Oct 202505:59	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in sha.js affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	29 Dec 202507:27	–	ibm
AstraLinux	Astra Linux - уязвимость в node-sha.js	3 May 202623:59	–	astralinux
Chainguard	CVE-2025-9288 vulnerabilities	3 Sep 202501:25	–	cgr
Circl	CVE-2025-9288	20 Aug 202521:59	–	circl
CNNVD	sha.js 安全漏洞	20 Aug 202500:00	–	cnnvd
Cvelist	CVE-2025-9288 Missing type checks leading to hash rewind and passing on crafted data	20 Aug 202521:59	–	cvelist

NVD

Node

browserify sha.jsRange≤2.4.11node.js

[
  {
    "collectionURL": "https://npmjs.com/sha.js",
    "defaultStatus": "unaffected",
    "packageName": "sha.js",
    "repo": "https://github.com/browserify/sha.js",
    "versions": [
      {
        "lessThanOrEqual": "2.4.11",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/browserify/sha.js/security/advisories/GHSA-95m3-7q98-8xr5
cve	www.cve.org/CVERecord
github	www.github.com/browserify/sha.js/pull/78
lists	www.lists.debian.org/debian-lts-announce/2025/09/msg00016.html

03 Nov 2025 19:16Current

7.2High risk

Vulners AI Score7.2

CVSS 3.19.1

CVSS 49.1

EPSS0.00064

SSVC

CWE-20