EUVD-2025-209373
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3Description
A cross-site scripting (XSS) vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Analysis
rrweb-snapshot before v2.0.0-alpha.18 contains a reflected cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript or HTML in a victim's browser context through a crafted payload. The vulnerability requires user interaction (clicking a malicious link) and affects client-side snapshot capture functionality. Publicly available exploit code exists according to CISA SSVC assessment, though active exploitation has not been confirmed at time of analysis.
Technical Context
rrweb-snapshot is a JavaScript library for capturing and replaying web page state, commonly used in session recording and debugging applications. The vulnerability stems from inadequate input sanitization in the snapshot rendering pipeline, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The library processes DOM elements and user-supplied data without sufficient XSS filters before injecting content into the DOM, allowing malicious script tags or event handlers to execute in the context of pages using the library. This affects the client-side snapshot capture mechanism used to serialize page state.
Affected Products
rrweb-snapshot versions prior to v2.0.0-alpha.18 are affected. The library is distributed as part of the rrweb project (https://github.com/rrweb-io/rrweb), with the vulnerable component located in the packages/rrweb-snapshot subdirectory. Specific upstream version information from vendor CPE was not available in advisory data; however, any deployment using rrweb-snapshot versions before the specified fix threshold should be considered at risk.
Remediation
Upgrade rrweb-snapshot to version v2.0.0-alpha.18 or later. Users should update their dependency to the patched version through npm or their package manager of choice. If immediate patching is not feasible, implement Content Security Policy (CSP) headers with script-src directives to mitigate XSS execution in the context where rrweb-snapshot is deployed. Refer to the upstream repository issue tracker at https://github.com/rrweb-io/rrweb/issues/1817 for additional technical details and patch confirmation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today