CVE-2025-12758: validator_project validator
Vulnerability summary
CVE-2025-12758 is a high (CVSS 8.7) vulnerability in validator_project validator. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 42.8% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 27-11-2025PublishedVulnerability first disclosed.
- 08-08-2026Last modifiedVulnerability information updated.
Description
Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.
CVSS metrics
7 scores · 5 sources · 2 versions- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
- OSV · NpmEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
- NVDNIST7.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
0.00 pp
From 0.52% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundAd31208B25B9E3D1E2E35F1D4D72572E
Maturity: poc
Exploit Reference (security.snyk.io)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-792Incomplete Filtering of One or More Instances of Special ElementsThe product receives data from an upstream component, but does not completely filter one or more instances of special elements before sending it to a downstream component.
- CWE-172Encoding ErrorThe product does not properly encode or decode the data, resulting in unexpected values.
Affected systems
Chainguard5 products
- redisinsight< 3.0.0-r0
- redisinsight-docker-entrypoint< 3.0.0-r0
- saf< 1.5.2-r0
- sqlpad< 7.5.7-r4
- sqlpad-compat< 7.5.7-r4
Wolfi3 products
- saf< 1.5.2-r0
- sqlpad< 7.5.7-r4
- sqlpad-compat< 7.5.7-r4
Npm1 product
- validator< 13.15.22
Validator_project1 product
- validator< 13.15.22
4 vendors · 10 products
