CVE-2025-32792
SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0, web pages and web extensions using `ses` and the Compartment API to evaluate third-party code in an isolated execution environment that have also elsewhere used `const`, `let`, and `class` bindings in the top-level scope of a `<script>` tag will have inadvertently revealed these bindings in the lexical scope of third-party code. This issue has been patched in version 1.12.0. Workarounds for this issue involve either avoiding top-level `let`, `const`, or `class` bindings in `<script>` tags, or change these to `var` bindings to be reflected on `globalThis`.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.54%
- CWE
- CWE-497
- Published
- 2025-04-18
- Last modified
- 2026-03-13
Affected products
- endojs endo
Weakness type
Related vulnerabilities
- CVE-2026-61911 — An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An...
- CVE-2026-81394 — Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-81387 — Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-69315 — Windows License Manager Information Disclosure Vulnerability
- CVE-2026-68842 — Windows MIDI Service Module Information Disclosure Vulnerability
- CVE-2026-71330 — Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability
- CVE-2026-69832 — Win32k Information Disclosure Vulnerability
- CVE-2026-69723 — Windows Kernel Information Disclosure Vulnerability