Is CVE-2025-32792 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-32792 being exploited in the wild.

How severe is CVE-2025-32792?

Medium severity, with a CVSS score of 4, published 18 April 2025.

Which products and versions are affected?

ses (npm) SEMVER:introduced=0,fixed=1.12.0.

Is there a fix for CVE-2025-32792?

Yes. ses (npm): upgrade to 1.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-32792 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-32792?

Check whether you run ses (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-32792: ses library variable scope leakage in Compartment isolation

CVE-2025-32792 · Severity: medium · CVSS 4 · Published 2025-04-18

ses is a JavaScript library that provides secure sandboxing capabilities for running untrusted third-party code in isolated execution environments called Compartments. A flaw in ses versions prior to 1.12.0 allows sensitive top-level variables (defined with let, const, or class) from the host page or extension to leak into the scope accessible by sandboxed third-party code, potentially exposing sensitive data or tokens to attackers.

Technologies: ses (npm). Vendors: npm.

Quick answers

Is CVE-2025-32792 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-32792 being exploited in the wild.
How severe is CVE-2025-32792?: Medium severity, with a CVSS score of 4, published 18 April 2025.
Which products and versions are affected?: ses (npm) SEMVER:introduced=0,fixed=1.12.0.
Is there a fix for CVE-2025-32792?: Yes. ses (npm): upgrade to 1.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-32792 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-32792?: Check whether you run ses (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ses (npm): upgrade to 1.12.0 or later
```
npm install ses@1.12.0
```

Technical details

The vulnerability is a scope leakage issue (CWE-497) in ses's Compartment API. The sandboxing mechanism uses a with-block and a semi-opaque scope Proxy to isolate third-party code execution. The proxy previously revealed any named property absent from globalThis to the surrounding lexical scope, leaking host-level bindings (let, const, class declarations) into the isolated environment's scope. Web pages and extensions using both ses Compartments and top-level lexical bindings in <script> tags are affected. The vulnerability requires no user interaction or authentication and is network-accessible in web contexts. Patches are available in ses version 1.12.0 and later, which makes the scope proxy fully opaque to prevent this leakage.

Affected products

Endo ses <1.12.0

Identifiers

CVE-2025-32792
GHSA-h9w6-f932-gq62

Timeline

2025-04-17: disclosed
2025-04-18: patched: ses version 1.12.0 released with fix
2025-04-18: advisory

References

https://github.com/endojs/endo/security/advisories/GHSA-h9w6-f932-gq62

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.