8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-27611

CVE-2025-27611: Homograph attack allows Unicode lookalike characters to bypass validation.

Impact

Attackers can deceive users into sending funds to an unintended address.

Patches

https://github.com/cryptocoinjs/base-x/pull/86

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-27611

CVE-2025-27611:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
base-x	npm	= 5.0.0	5.0.1
base-x	npm	= 4.0.0	4.0.1
base-x	npm	<= 3.0.10	3.0.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows homograph attacks due to improper handling of Unicode characters with char codes greater than 255 during the decoding process. The provided commit 831716afd2d6e9f1c1e28cdf84ccb1eb17692e43 patches this issue. The patch modifies the decode method (which is part of the object returned by the base factory function) in three different module formats (cjs, esm, ts). In each case, the core logic change is the addition of a check to ensure that the character code obtained from the input string is not greater than 255 before using it to access the BASE_MAP. If charCode > 255, the function now returns, effectively treating such characters as invalid for the given base encoding. Before this change, character codes greater than 255 could be used to index BASE_MAP, leading to undefined behavior or incorrect decoding, which could be exploited by using Unicode characters that look similar to valid base characters but have different char codes.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.