AZL-63704 CVE-2025-5889 affecting package js-jquery 3.5.0-4

🗓️ 09 Jun 2025 19:15:25Reported by GoogleType

Brace-expansion expand function vulnerability up to 4.0.0 enables remote attack; upgrade to fixed versions.

Reporter	Title	Published	Views	Family All 154
IBM Security Bulletins	Security Bulletin: Carbon design system packages	18 Aug 202519:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses flask-3.1.2-py3-none-any.whl which is vulnerable to CVE-2026-27205.	6 Apr 202618:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is vulnerable to a denial of service	4 Mar 202605:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	16 Feb 202609:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	16 Oct 202507:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses brace-expansion-1.1.11.tgz which is vulnerable to CVE-2025-5889.	29 Dec 202503:28	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in brace-expansion, tmp, urllib3, pycryptodomex and cross-site request forgery might affect IBM Storage Defender Sentinel Anomaly Scan Engine.	12 Dec 202513:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses brace-expansion-1.1.11.tgz which is vulnerable to CVE-2025-5889.	29 Dec 202503:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses brace-expansion-2.0.1.tgz which is vulnerable to this CVE-2025-5889	9 Oct 202512:12	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in juliangruber affects IBM watsonx Orchestrate with watsonx Assistant Cartridge	22 Jan 202605:05	–	ibm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-5889

21 Apr 2026 04:32Current

4.9Medium risk

Vulners AI Score4.9

CVSS 22.1

CVSS 42.3

CVSS 3.13.1

CVSS 33.1

EPSS0.00092

SSVC