CVE-2025-45806 rrweb-io CVE debrief

Who should care

Defenders responsible for web application security, particularly those using rrweb-snapshot, should assess exposure and prioritize verification and remediation. This includes reviewing and updating web application code to prevent XSS attacks and considering the implementation of Content Security Policy (CSP) to mitigate such attacks. Additionally, defenders should verify the version of rrweb-snapshot in use and assess the exposure of web applications that

Why it matters

A cross-site scripting (XSS) vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload, requiring defenders to verify version and assess exposure.

• Defenders must verify the version of rrweb-snapshot in use to determine exposure.
• Web applications utilizing rrweb-snapshot may be vulnerable to XSS attacks.
• Defenders should review and update web application code to prevent XSS attacks.
• Implementing Content Security Policy (CSP) may mitigate XSS attacks.

Technical summary

A cross-site scripting (XSS) vulnerability exists in rrweb-snapshot before v2.0.0-alpha.18, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload. The vulnerability affects web applications that utilize rrweb-snapshot, and defenders should verify the version in use and assess exposure. This vulnerability has a CVSS score of 6.1 and a severity of MEDIUM, indicating a moderate risk to web applications utilizing rrweb-snapshot. Defenders should prioritize verifying the version of rrweb-snapshot and assessing the exposure of web applications that utilize this library.

Defensive priority

Defenders should prioritize verifying the version of rrweb-snapshot in use and assessing the exposure of web applications that utilize this library.

Recommended defensive actions

• Verify the version of rrweb-snapshot in use and assess the exposure of web applications that utilize this library.
• Review and update web application code to prevent XSS attacks.
• Implement Content Security Policy (CSP) to mitigate XSS attacks.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its CVSS score and severity. The vulnerability is confirmed in rrweb-snapshot before v2.0.0-alpha.18. Defenders should verify the version of rrweb-snapshot in use and assess the exposure of web applications that utilize this library. Evidence is limited to public sources, and further verification is required to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.