Executive brief
base-x is a JavaScript library used to encode and decode data in various base formats, commonly used in cryptocurrency applications. A homograph attack vulnerability allows attackers to use visually similar Unicode characters to bypass validation checks, potentially deceiving users into sending funds to a malicious address instead of the intended recipient.
Technical details
This vulnerability is a homograph attack (CWE-1007) where Unicode lookalike characters can bypass validation logic in the base-x encoding/decoding library. The vulnerability affects versions 3.0.10 and below, 4.0.0, and 5.0.0 of the base-x npm package. An attacker can exploit this without authentication or user interaction by crafting a malicious encoded string using visually indistinguishable Unicode characters. The primary impact is tricking users into sending cryptocurrency to an attacker-controlled address. Patches have been released in versions 3.0.11, 4.0.1, and 5.0.1.
Affected products
- cryptocoinjs base-x 3.0.10 and below, 4.0.0, 5.0.0
Timeline
- 2025-04-30: disclosed: Public disclosure via GitHub advisory GHSA-xq7p-g2vc-g82p
- 2025-04-30: patched: Patches released: base-x 3.0.11, 4.0.1, 5.0.1
- 2025-04-30: advisory: CVE-2025-27611 published