8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-47425

CVE-2025-47425: Reflex vulnerable to private state fields modification

Summary

A user on the website can modify any private field on their own state.

Details

An event meant to modify client side storage had access to modify any field on the state for the given user. This includes non-client side ones and most importantly private fields. This still requires the actor to guess the name for the private fields.

Impact

If one of the States in your app can be modified to allow the user into a different role or a different user this allows the actor to act as someone else or as admin.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-47425

CVE-2025-47425:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
reflex	pip	>= 0.2.7, < 0.4.9.post1	0.4.9.post1
reflex	pip	> 0.4.9.post1, < 0.5.10.post1	0.5.10.post1
reflex	pip	> 0.5.10.post1, < 0.6.8.post1	0.6.8.post1
reflex	pip	> 0.6.8.post1, < 0.7.1.post1	0.7.1.post1
reflex	pip	> 0.7.1.post1, < 0.7.2.post1	0.7.2.post1
reflex	pip	> 0.7.2.post1, < 0.7.3.post1	0.7.3.post1
reflex	pip	> 0.7.3.post1, < 0.7.4.post1	0.7.4.post1
reflex	pip	> 0.7.4.post1, < 0.7.5.post1	0.7.5.post1
reflex	pip	> 0.7.5.post1, < 0.7.6.post1	0.7.6.post1
reflex	pip	> 0.7.6.post1, < 0.7.7.post1	0.7.7.post1
reflex	pip	> 0.7.7.post1, < 0.7.8.post1	0.7.8.post1
reflex	pip	> 0.7.8.post1, < 0.7.9.post1	0.7.9.post1
reflex	pip	> 0.7.9.post1, < 0.7.10.post1	0.7.10.post1
reflex	pip	> 0.7.10.post1, < 0.7.11	0.7.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description states that 'An event meant to modify client side storage had access to modify any field on the state for the given user.' The provided commit cf8f5dbcbdd996f3478a7be660993f9c760ede36 directly addresses this in the reflex/state.py file. The update_vars_internal method within the State class was modified. Before the patch, this method iterated through input variables and used setattr to update state variables without checking if they were client-side storage variables. This allowed arbitrary modification of state fields. The patch introduced a call to a new method _is_client_storage to ensure that only designated client storage variables can be updated by this mechanism. Therefore, reflex.state.State.update_vars_internal is the vulnerable function as it processed the malicious input (arbitrary state modifications) without proper validation.

The new function _is_client_storage and the modifications to _reset_client_storage are part of the mitigation, not the vulnerable code itself. They are introduced to correctly identify and handle client-side storage variables, which was the missing check in the vulnerable version of update_vars_internal.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.