endojs endo up to 1.11.x Compartment API information expsure

Summaryinfo

A vulnerability classified as problematic has been found in endojs endo up to 1.11.x. The impacted element is an unknown function of the component Compartment API. The manipulation leads to information expsure. This vulnerability is referenced as CVE-2025-32792. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in endojs endo up to 1.11.x. It has been rated as problematic. This issue affects some unknown processing of the component Compartment API. The manipulation with an unknown input leads to a information expsure vulnerability. Using CWE to declare the problem leads to CWE-497. The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. Impacted is confidentiality. The summary by CVE is:

SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0, web pages and web extensions using `ses` and the Compartment API to evaluate third-party code in an isolated execution environment that have also elsewhere used `const`, `let`, and `class` bindings in the top-level scope of a `` tag will have inadvertently revealed these bindings in the lexical scope of third-party code. This issue has been patched in version 1.12.0. Workarounds for this issue involve either avoiding top-level `let`, `const`, or `class` bindings in `` tags, or change these to `var` bindings to be reflected on `globalThis`.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-32792 since 04/10/2025. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 1.12.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• endojs

Name

• endo

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11

Website

• Product: https://github.com/endojs/endo/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion