Publish GHSA-3h52-269p-cp9r

advisories/github-reviewed/2025/05/GHSA-3h52-269p-cp9r/GHSA-3h52-269p-cp9r.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3h52-269p-cp9r",
-  "modified": "2025-05-28T21:52:13Z",
+  "modified": "2025-05-29T16:48:53Z",
   "published": "2025-05-28T21:52:13Z",
   "aliases": [
     "CVE-2025-48068"
   ],
   "summary": "Information exposure in Next.js dev server due to lack of origin verification",
-  "details": "### Summary\nThis vulnerability is similar to CVE-2018-14732. When running a Next.js server locally (e.g. through `npm run dev`), the WebSocket server is vulnerable to the Cross-site WebSocket hijacking (CSWSH) attack. and a bad actor can access the source code of client components, if a user was to visit a malicious link while having the Next.js dev server running.\n\n### Impact\nIf a user is running a Next.js server locally (e.g. `npm run dev`), and they were to browse to a malicious website, the malicious website may be able to access the source code of the Next.js app. This vulnerability only affects applications making use of App Router.\n\n_Note: App Router was experimental requiring_ `experimental.appDir = true` _in versions_ `>=13.0.0` to  `<13.4`.",
+  "details": "## Summary\n\nA low-severity vulnerability in **Next.js** has been fixed in **version 15.2.2**. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while `npm run dev` is active.\n\nLearn more: https://vercel.com/changelog/cve-2025-48068\n\n## Credit\n\nThanks to [sapphi-red](https://github.com/sapphi-red) and [Radman Siddiki](https://github.com/R4356th) for responsibly disclosing this issue.",
   "severity": [
     {
       "type": "CVSS_V4",
@@ -43,6 +43,10 @@
     {
       "type": "PACKAGE",
       "url": "https://github.com/vercel/next.js"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vercel.com/changelog/cve-2025-48068"
     }
   ],
   "database_specific": {