CVE-2025-58765: 
JavaScript vulnerability analysis and mitigation

CVE-2025-58765 is a Reflected Cross-Site Scripting (XSS) vulnerability in the 404 error handling logic of wabac.js, a web archive replay system ("wayback machine") built on Service Workers. The requestURL parameter — derived from the original request target — is directly embedded into an inline <script> block without sanitization or escaping, allowing an attacker to craft a malicious URL that executes arbitrary JavaScript in a victim's browser. The vulnerability affects @webrecorder/wabac (npm) versions below 2.23.11, @webrecorder/archivewebpage versions below 0.15.4, and replaywebpage versions below 2.3.17. It was reported by researcher Dedal0, published to the GitHub Advisory Database on September 8, 2025, and assigned CVE on September 9, 2025. The CVSS v3.1 base score is 7.1 (High) (GitHub Advisory, wabac.js Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). In the vulnerable getHTMLNotFound() function within src/notfound.ts, the requestURL value was interpolated directly into a JavaScript string literal inside an inline <script> block using template literals (e.g., window.requestURL = "${requestURL}";), with no escaping or sanitization applied. An attacker can break out of the string context by crafting a URL containing characters such as " followed by arbitrary JavaScript (e.g., https://example.com/foobar"+alert(document.cookie);//), causing the injected code to execute when the 404 error page is rendered. The fix, applied in commit 25feb4a, replaces direct string interpolation with JSON.stringify() encoding, passing values to <data> tags and setting HTML element content via innerText on the client side (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the context of the wabac.js Service Worker origin. This can lead to session cookie theft, session hijacking, unauthorized actions performed on behalf of the user, and potential access to archived content displayed through the replay system. The advisory notes that the scope is marked "Changed" in CVSS, reflecting that the impact can extend beyond the vulnerable component; however, existing CORS policies on the error page partially mitigate the blast radius depending on the deployment context (GitHub Advisory, Fix Commit).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). No threat actor attribution has been reported. The EPSS score is approximately 0.033–0.085%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must click or be redirected to a specially crafted URL that triggers the 404 error page in a vulnerable wabac.js deployment.

1. Identify a vulnerable deployment: Locate a web application using @webrecorder/wabac < 2.23.11, @webrecorder/archivewebpage < 0.15.4, or replaywebpage < 2.3.17 — such as a self-hosted ReplayWeb.page instance.
2. Craft a malicious URL: Construct a URL targeting a non-existent archived resource that includes a JavaScript injection payload breaking out of the string context, for example: https://[replay-host]/[archive]/https://example.com/foobar"+alert(document.cookie);//
3. Trigger the 404 error page: Ensure the crafted URL causes wabac.js to render its getHTMLNotFound() error page, which embeds the unsanitized requestURL into the inline <script> block.
4. Deliver to victim: Send the malicious URL to a target user via phishing, social engineering, or embedding it in a webpage. When the victim navigates to the URL, the injected JavaScript executes in their browser.
5. Achieve objective: The executed script can steal session cookies, exfiltrate data, perform actions on behalf of the user, or redirect the victim to an attacker-controlled site (GitHub Advisory, Fix Commit).

• Network: Unusual outbound requests from a victim's browser to attacker-controlled domains following navigation to a wabac.js-hosted 404 error page; HTTP requests containing URL-encoded JavaScript payloads (e.g., %22%2Balert, "+alert) in the path or query string targeting a wabac.js replay endpoint.
• Logs: Web server or Service Worker access logs showing requests to archived resource paths containing special characters such as ", +, //, or JavaScript keywords (alert, document.cookie, fetch) in the URL path.
• Browser: Unexpected JavaScript execution or pop-ups when navigating to a 404 error page within a wabac.js-powered replay interface; browser developer console errors related to script execution on the replay origin.

Upgrade to the patched versions immediately: @webrecorder/wabac v2.23.11, @webrecorder/archivewebpage v0.15.4, or replaywebpage v2.3.17. The fix replaces unsafe string interpolation with JSON.stringify() encoding and uses innerText assignment rather than direct HTML embedding, eliminating the injection point. As a defense-in-depth measure, deploy a strict Content Security Policy (CSP) to restrict inline script execution and limit the impact of any similar future issues. No configuration-only workaround is available for the underlying vulnerability (GitHub Advisory, wabac.js v2.23.11 Release).

The vulnerability was reported by security researcher Dedal0 and responsibly disclosed to the Webrecorder project maintainers, who acknowledged the existing CORS policy as a partial mitigating factor while confirming it did not fully prevent exploitation. The fix was developed and released promptly by maintainer emma-sg. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified (wabac.js Advisory, Fix Commit).