{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-29T05:25:11.641","vulnerabilities":[{"cve":{"id":"CVE-2025-54590","sourceIdentifier":"security-advisories@github.com","published":"2025-08-01T18:15:55.577","lastModified":"2026-06-17T09:40:21.370","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"webfinger.js is a TypeScript-based WebFinger client that runs in both browsers and Node.js environments. In versions 2.8.0 and below, the lookup function accepts user addresses for account checking. However, the ActivityPub specification requires preventing access to localhost services in production. This library does not prevent localhost access, only checking for hosts that start with \"localhost\" and end with a port. Users can exploit this by creating servers that send GET requests with controlled host, path, and port parameters to query services on the instance's host or local network, enabling blind SSRF attacks. This is fixed in version 2.8.1."},{"lang":"es","value":"webfinger.js es un cliente WebFinger basado en TypeScript que funciona tanto en navegadores como en entornos Node.js. En las versiones 2.8.0 y anteriores, la función de búsqueda acepta direcciones de usuario para la comprobación de cuentas. Sin embargo, la especificación ActivityPub exige impedir el acceso a los servicios del host local en producción. Esta librería no impide el acceso al host local, sino que solo comprueba los hosts que empiezan por \"localhost\" y terminan con un puerto. Los usuarios pueden aprovechar esto creando servidores que envíen solicitudes GET con parámetros de host, ruta y puerto controlados para consultar servicios en el host o la red local de la instancia, lo que permite ataques SSRF ciegos. Esto se ha corregido en la versión 2.8.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"silverbucket","product":"webfinger.js","versions":[{"version":"< 2.8.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-08-01T18:39:19.551343Z","id":"CVE-2025-54590","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/silverbucket/webfinger.js/commit/b5f2f2c957297d25f4d76072963fccaee2e3095a","source":"security-advisories@github.com"},{"url":"https://github.com/silverbucket/webfinger.js/releases/tag/v2.8.1","source":"security-advisories@github.com"},{"url":"https://github.com/silverbucket/webfinger.js/security/advisories/GHSA-8xq3-w9fx-74rv","source":"security-advisories@github.com"}]}}]}