Is CVE-2025-66402 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-66402 being exploited in the wild.

How severe is CVE-2025-66402?

Medium severity, with a CVSS score of 6.5, published 16 December 2025.

Which products and versions are affected?

misskey-js (npm) SEMVER:introduced=13.0.0-beta.16,fixed=2025.12.0.

Is there a fix for CVE-2025-66402?

Yes. misskey-js (npm): upgrade to 2025.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-66402 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-66402?

Check whether you run Misskey or misskey-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-66402: Misskey.js export data contains private post data

CVE-2025-66402 · Severity: medium · CVSS 6.5 · Published 2025-12-16

Misskey.js is a JavaScript library for interacting with Misskey, a social media platform similar to Mastodon. When users export their favorites or clips, the exported data can inadvertently include the full content of private posts (restricted to followers or specific users) that the exporting user should not have permission to view. An attacker who can add private posts to their favorites or clips can export and read content they shouldn't have access to, potentially exposing sensitive communications or pinned private posts.

Technologies: Misskey. Vendors: Misskey, npm.

Quick answers

Is CVE-2025-66402 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-66402 being exploited in the wild.
How severe is CVE-2025-66402?: Medium severity, with a CVSS score of 6.5, published 16 December 2025.
Which products and versions are affected?: misskey-js (npm) SEMVER:introduced=13.0.0-beta.16,fixed=2025.12.0.
Is there a fix for CVE-2025-66402?: Yes. misskey-js (npm): upgrade to 2025.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-66402 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-66402?: Check whether you run Misskey or misskey-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

misskey-js (npm): upgrade to 2025.12.0 or later
```
npm install misskey-js@2025.12.0
```

Technical details

The vulnerability exists in Misskey.js's export functionality for user favorites and clips. The root cause is insufficient authorization checks when exporting post data—the export routine fails to validate whether the exporting user has permission to view the posts being exported. An attacker can add private posts (followers-only or directed to specific users) to their favorites or clips by referencing their URLs, then export the collection to retrieve the full post content without proper access control. The attack requires authentication and network access but no user interaction beyond the export action. The vulnerability was fixed in Misskey version 2025.12.0. CWE-862 (Missing Authorization) is the underlying weakness.

Affected products

Misskey-dev misskey-js >=13.0.0-beta.16, <2025.12.0

Identifiers

CVE-2025-66402
GHSA-496g-mmpw-j9x3

Timeline

2025-12-15: disclosed
2025-12-01: patched: Fix available in version 2025.12.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.