Junglewise Threat Intelligence

CVE-2025-27611: base-x homograph attack allows Unicode lookalike character bypass

CVE-2025-27611 · Severity: medium · CVSS 4 · Published 2025-04-30

Executive brief

base-x is a JavaScript library used to encode and decode data in various base formats, commonly used in cryptocurrency applications. A homograph attack vulnerability allows attackers to use visually similar Unicode characters to bypass validation checks, potentially deceiving users into sending funds to a malicious address instead of the intended recipient.

Technical details

This vulnerability is a homograph attack (CWE-1007) where Unicode lookalike characters can bypass validation logic in the base-x encoding/decoding library. The vulnerability affects versions 3.0.10 and below, 4.0.0, and 5.0.0 of the base-x npm package. An attacker can exploit this without authentication or user interaction by crafting a malicious encoded string using visually indistinguishable Unicode characters. The primary impact is tricking users into sending cryptocurrency to an attacker-controlled address. Patches have been released in versions 3.0.11, 4.0.1, and 5.0.1.

Affected products

  • cryptocoinjs base-x 3.0.10 and below, 4.0.0, 5.0.0

Timeline

  • 2025-04-30: disclosed: Public disclosure via GitHub advisory GHSA-xq7p-g2vc-g82p
  • 2025-04-30: patched: Patches released: base-x 3.0.11, 4.0.1, 5.0.1
  • 2025-04-30: advisory: CVE-2025-27611 published

References