CVE-2025-69871

A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage...

CVE-2025-69871

A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage...

UBUNTU-CVE-2025-69871

A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage...

CVE-2025-69871

A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage...

CVE-2025-69871

A race condition vulnerability exists in MedusaJS Medusa version v2.12.2 and earlier within the registerUsage() function of the promotion module. The flaw stems from a non-atomic read-check-update operation used to enforce promotion usage limits. This allows unauthenticated remote attackers to by...

PT-2026-7635

Name of the Vulnerable Software and Affected Versions MedusaJS versions prior to 2.12.2 Description A race condition exists in the registerUsage function within the promotion module. This function uses a non-atomic read-check-update process when managing promotion usage limits. This allows...

CVE-2025-69871

A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage...

CVE-2025-69871

A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage...

CVE-2025-69871: Concurrent Execution using Shared Resource with Improper Synchronization

A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage...

CVE-2025-69871

A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage...

97shop-medusa-admin (>=0.1.0, <=0.1.1), @bytewizardry/medusa-plugin-ses (>=3.0.1-canary.8, <=3.0.1-canary.12) +181 more potentially affected by CVE-2025-69871 via @medusajs/medusa (>=1.3.4, <=2.11.3)

@medusajs/medusa NPM version =1.3.4, =0.1.0, =3.0.1-canary.8, =1.0.0, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =1.0.0, =1.0.0, =0.0.6, =0.0.1, =0.0.1, =1.0.10, =1.2.3, =1.2.5 and more Source cves: CVE-2025-69871 Source advisory: MEND:CVE-2025-69871...

97shop-medusa-admin (>=0.1.0, <=0.1.1), @ai-ecom/medusa-plugin-employee (0.2.0) +384 more potentially affected by CVE-2025-69871 via @medusajs/utils (>=0.0.1, <=2.11.4-snapshot-20251107212527)

@medusajs/utils NPM version =0.0.1, =0.1.0, =1.12.0, =0.0.1, =3.0.1-canary.8, =1.0.0, =1.0.0, =0.0.1, =2.0.3-beta.1, =3.0.1-beta.0, =1.20.9-i1, =1.0.0, =1.0.1 and more Source cves: CVE-2025-69871 Source advisory: MEND:CVE-2025-69871...

@ameerrizvi/medusajs-admin-bundler (>=1.0.1, <=1.0.8), @ameerrizvi/medusajs-medusa (1.0.3) +8 more potentially affected by CVE-2025-69871 via @medusajs/dashboard (>=0.0.1, <=2.11.3)

@medusajs/dashboard NPM version =0.0.1, =1.0.1, =0.0.1, =0.0.1, =1.20.6-rc-20241015165116, =1.0.0-rc-20241001083650, =2.8.4, =0.0.2, =0.0.3 - my-test-store 0.0.1 - thrivo-admin-dashboard 1.0.0 Source cves: CVE-2025-69871 Source advisory: MEND:CVE-2025-69871...

97shop-medusa-admin (>=0.1.0, <=0.1.1), @ai-ecom/medusa-plugin-employee (0.2.0) +411 more potentially affected by CVE-2025-69871 via @medusajs/types (>=0.0.2-next-20230324075823, <=2.11.4-snapshot-20251107212527)

@medusajs/types NPM version =0.0.2-next-20230324075823, =0.1.0, =1.0.1, =1.0.1, =1.12.0, =1.0.0, =0.0.1, =1.0.0, =3.0.1-canary.8, =1.0.0, =1.2.0 and more Source cves: CVE-2025-69871 Source advisory: MEND:CVE-2025-69871...

@ameerrizvi/medusajs-medusa (1.0.3), @godscodes/medusa-product-reviews (>=0.0.1, <=0.0.4) +5 more potentially affected by CVE-2025-69871 via @medusajs/promotion (>=0.0.5-rc-20241015165116, <=2.11.3)

@medusajs/promotion NPM version =0.0.5-rc-20241015165116, =0.0.1, =1.20.6-rc-20241015165116, =1.0.0-rc-20241001083650, =2.8.4, =0.0.2, =0.0.3 - my-test-store 0.0.1 Source cves: CVE-2025-69871 Source advisory: MEND:CVE-2025-69871...

Exploit for CVE-2025-69871

Ethan Public Disclosures Security vulnerability disclosures a...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The package was flagged as malicious during the Sha1-hulud supply chain attack. Although the Sha1-hulud IoCs are not present within the package, the contents of the affected version were removed from the officia...

Malware in @medusajs/medusa-oas-cli

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @medusajs/medusa

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @medusajs/analytics-posthog

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...