Description
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter requestURL (derived from the original request target) is directly embedded into an inline <script> block without sanitization or escaping.
Recommendation
Update the @webrecorder/wabac package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.23.11
- Patched version(s): 2.23.11
References
Could your website be exposed too?
SmartScanner can check your website for Webrecorder packages are vulnerable to XSS through 404 error handling logic - @webrecorder/wabac and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Webrecorder packages are vulnerable to XSS through 404 error handling logic - CVE-2025-58765
- Webrecorder packages are vulnerable to XSS through 404 error handling logic - replaywebpage - CVE-2025-58765
- @pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation - CVE-2025-53626
- @sveltejs/kit vulnerable to XSS on dev mode 404 page - CVE-2024-53261
You might also like:
See something that needs correcting? Let us knowUpdated September 10, 2025