CVE-2025-32792: ses's global contour bindings leak into Compartment lexical scope

April 18, 2025 (updated October 31, 2025)

Web pages and web extensions using ses and the Compartment API to evaluate third-party code in an isolated execution environment that have also elsewhere used const, let, and class bindings in the top-level scope of a <script> tag will have inadvertently revealed these bindings in the lexical scope of third-party code.

References

github.com/advisories/GHSA-h9w6-f932-gq62
github.com/endojs/endo
github.com/endojs/endo/security/advisories/GHSA-h9w6-f932-gq62
nvd.nist.gov/vuln/detail/CVE-2025-32792

Code Behaviors & Features

Detect and mitigate CVE-2025-32792 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →