Detections
Analytics

SCA: security update for validator (GHSA-vghf-hv5q-vc2g)

high Tenable Cloud Security Plugin ID 436187

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More
 Instances of Special Elements in the isLength() function that does not take into account Unicode variation
 selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This
 can lead to an application using isLength for input validation accepting strings significantly longer than
 intended, resulting in issues like data truncation in databases, buffer overflows in other system
 components, or denial-of-service. (CVE-2025-12758)

See Also

https://github.com/advisories/GHSA-vghf-hv5q-vc2g

Plugin Details

Severity: High

ID: 436187

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 12/2/2025

Updated: 6/30/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2025-12758

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 8.7

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/27/2025

Vulnerability Publication Date: 11/27/2025

Reference Information

CVE: CVE-2025-12758