CVE-2025-59038: Prebid.js NPM package briefly compromised

Deferred

AliasesGHSA-jwq7-6j4r-2f92MAL-2025-46990

Published 09-09-2025Last modified 10-09-2025

Vulnerability summary

CVE-2025-59038 is a high (CVSS 8.6) Embedded Malicious Code vulnerability in prebid prebid.js. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.4% of scored vulnerabilities.

Overall risk

34/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.6/10

010

High · v4.0 (CVE.org)

EPSS score

0.35%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

09-09-2025
PublishedVulnerability first disclosed.
10-09-2025
Last modifiedVulnerability information updated.

Description

Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the attackers' wallet. Version 10.10.0 fixes the issue. As a workaround, it is also possible to downgrade to 10.9.1.