From 5cbd26cb3fd49a7a0078374a377ba0508ad3dbcc Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 29 May 2025 16:50:07 +0000
Subject: [PATCH] Publish GHSA-3h52-269p-cp9r

---
 .../2025/05/GHSA-3h52-269p-cp9r/GHSA-3h52-269p-cp9r.json  | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/advisories/github-reviewed/2025/05/GHSA-3h52-269p-cp9r/GHSA-3h52-269p-cp9r.json b/advisories/github-reviewed/2025/05/GHSA-3h52-269p-cp9r/GHSA-3h52-269p-cp9r.json
index 8e912a29681..fe1ddacb55d 100644
--- a/advisories/github-reviewed/2025/05/GHSA-3h52-269p-cp9r/GHSA-3h52-269p-cp9r.json
+++ b/advisories/github-reviewed/2025/05/GHSA-3h52-269p-cp9r/GHSA-3h52-269p-cp9r.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3h52-269p-cp9r",
-  "modified": "2025-05-28T21:52:13Z",
+  "modified": "2025-05-29T16:48:53Z",
   "published": "2025-05-28T21:52:13Z",
   "aliases": [
     "CVE-2025-48068"
   ],
   "summary": "Information exposure in Next.js dev server due to lack of origin verification",
-  "details": "### Summary\nThis vulnerability is similar to CVE-2018-14732. When running a Next.js server locally (e.g. through `npm run dev`), the WebSocket server is vulnerable to the Cross-site WebSocket hijacking (CSWSH) attack. and a bad actor can access the source code of client components, if a user was to visit a malicious link while having the Next.js dev server running.\n\n### Impact\nIf a user is running a Next.js server locally (e.g. `npm run dev`), and they were to browse to a malicious website, the malicious website may be able to access the source code of the Next.js app. This vulnerability only affects applications making use of App Router.\n\n_Note: App Router was experimental requiring_ `experimental.appDir = true` _in versions_ `>=13.0.0` to  `<13.4`.",
+  "details": "## Summary\n\nA low-severity vulnerability in **Next.js** has been fixed in **version 15.2.2**. This issue may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while `npm run dev` is active.\n\nLearn more: https://vercel.com/changelog/cve-2025-48068\n\n## Credit\n\nThanks to [sapphi-red](https://github.com/sapphi-red) and [Radman Siddiki](https://github.com/R4356th) for responsibly disclosing this issue.",
   "severity": [
     {
       "type": "CVSS_V4",
@@ -43,6 +43,10 @@
     {
       "type": "PACKAGE",
       "url": "https://github.com/vercel/next.js"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vercel.com/changelog/cve-2025-48068"
     }
   ],
   "database_specific": {