CVE-2025-27611
base-x homograph attack allows Unicode lookalike characters to bypass validation.
- State
- Published
- Severity
- 8.7 High
- Published
- Apr 30, 2025
- Updated
- May 1, 2025
- Reserved
- Mar 3, 2025
Description
base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This issue has been patched in versions 3.0.11, 4.0.1, and 5.0.1.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | GitHub_M |
Weaknesses
- CWE-1007 Insufficient Visual Distinction of Homoglyphs Presented to User
Affected Products
| Product | Versions |
|---|---|
base-xcryptocoinjs |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.