CVE-2026-48063: 
JavaScript vulnerability analysis and mitigation

CVE-2026-48063 is a message spoofing and app state corruption vulnerability in the Baileys WhatsApp Web API library (@whiskeysockets/baileys and baileys npm packages). An unauthenticated remote attacker can send a maliciously crafted protocolMessage payload via placeholderResendMessage to trigger fake messages.upsert events, spoof message content, corrupt the app state sync system, and inject fake history sync data. Affected versions are @whiskeysockets/baileys < 6.7.22 and >= 7.0.0-rc.1, < 7.0.0-rc12. It was first published on May 20, 2026, and added to the GitHub Advisory Database on June 10, 2026. The CVSS v4 base score is 9.3 (Critical) (GitHub Advisory).

The root cause is insufficient origin validation of inbound protocolMessage types in Baileys' process-message.ts handler (CWE-290, CWE-345, CWE-346). Specifically, self-only protocol message types — HISTORY_SYNC_NOTIFICATION, APP_STATE_SYNC_KEY_SHARE, LID_MIGRATION_MAPPING_SYNC, and PEER_DATA_OPERATION_REQUEST_RESPONSE_MESSAGE — were not guarded against non-self senders, meaning any external party could send these message types and have them processed as if they originated from the victim's own device. The attack requires no authentication, no special privileges, and no user interaction; an attacker only needs to be able to send a WhatsApp message to the target Baileys session. The fix, implemented in commit 3beb08e, introduces a SELF_ONLY_TYPES set and drops any such protocol message where message.key.fromMe is false, mirroring the guard used in the reference implementation whatsmeow (GitHub Commit, GitHub Advisory).

Successful exploitation allows an attacker to spoof arbitrary messages in a Baileys session, making fabricated messages appear legitimate to the application and its users. Additionally, the attacker can corrupt the app state sync system by injecting fake key shares, and can manipulate history sync to inject false prior conversation context or trigger on-demand sync with fabricated data. This undermines the integrity and confidentiality of all communications processed by the affected Baileys session, and could be leveraged to deceive users or downstream systems that rely on message authenticity (GitHub Advisory).

1. Identify target: Locate a Baileys-based WhatsApp bot or application running a vulnerable version (< 6.7.22 or >= 7.0.0-rc.1, < 7.0.0-rc12) by interacting with known WhatsApp bots or services built on the Baileys library.
2. Craft malicious protocolMessage payload: Construct a WhatsApp protocol buffer message of type HISTORY_SYNC_NOTIFICATION or APP_STATE_SYNC_KEY_SHARE with a spoofed message key and arbitrary payload content, embedding it within a placeholderResendMessage structure.
3. Send payload to target session: Deliver the crafted message to the target Baileys session's WhatsApp JID. Because the library does not validate the fromMe field for self-only protocol message types, the message is accepted as if it originated from the victim's own device.
4. Trigger fake messages.upsert event: The malicious payload causes the Baileys session to emit a messages.upsert event with the attacker-controlled fake message key and content, which the application processes as a legitimate inbound message.
5. Achieve objectives: Depending on the payload type, the attacker can spoof message content visible to the application, corrupt the app state sync by injecting fake key shares, or inject fabricated conversation history via history sync spoofing (GitHub Advisory, GitHub Commit).

• Logs: Unexpected messages.upsert events containing a requestId field in Baileys application logs; log entries showing HISTORY_SYNC_NOTIFICATION or APP_STATE_SYNC_KEY_SHARE protocol messages received from non-self JIDs (after patching, these will appear as warnings: 'dropping spoofed self-only protocolMessage from non-self origin').
• Application Behavior: Sudden appearance of unexpected or fabricated messages in the application's message store; unexplained changes to app state sync keys or history sync data; history sync events triggered without user action.
• Network: Inbound WhatsApp protocol messages of self-only types (HISTORY_SYNC_NOTIFICATION, APP_STATE_SYNC_KEY_SHARE, LID_MIGRATION_MAPPING_SYNC, PEER_DATA_OPERATION_REQUEST_RESPONSE_MESSAGE) originating from external JIDs rather than the session's own device (GitHub Commit).

Upgrade to @whiskeysockets/baileys version 6.7.22 (for v6 users) or 7.0.0-rc12 (for v7 users), which contain the fix in commit 3beb08e. As a partial workaround, applications can drop messages.upsert events that contain a requestId field, and disable automatic history sync by setting shouldSyncHistoryMessage: () => false in the socket configuration. Note that there is no workaround for the app state sync jamming vector — upgrading is the only complete remediation (GitHub Advisory, GitHub Commit).

The advisory was published by researcher purpshell (credited as the finder) and remediated by SheIITear on May 20, 2026, with the GitHub Advisory Database entry published June 10, 2026. No significant broader media coverage or notable public social media discussion has been identified beyond the GitHub advisory and OSV database entries (GitHub Advisory).