Detections
Analytics
SCA: security update for darkreader (GHSA-x369-mcw8-8rvj)
low Tenable Self-Hosted Container Security Plugin ID 438334
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Dark Reader is an accessibility browser extension that makes web pages colors dark. The dynamic dark mode
feature of the extension works by analyzing the colors of web pages found in CSS style sheet files. In
order to analyze cross-origin style sheets (stored on websites different from the original web page), Dark
Reader requests such files via a background worker, ensuring the request is performed with no credentials
and that the content type of the response is a CSS file. Prior to Dark Reader 4.9.117, this style content
was assigned to an HTML Style Element in order to parse and loop through style declarations, and also
stored in page's Session Storage for performance gains. This could allow a website author to request a
style sheet from a locally running web server, for example by having a link pointing to
`http[:]//localhost[:]8080/style[.]css`. The brute force of the host name, port and file name would be
unlikely due to performance impact, that would cause the browser tab to hang shortly, but it could be
possible to request a style sheet if the full URL was known in advance. As per December 18, 2025 there is
no known exploit of the issue. The problem has been fixed in version 4.9.117 on December 3, 2025. The
style sheets are now parsed using modern Constructed Style Sheets API and the contents of cross-origin
style sheets is no longer stored in page's Session Storage. Version 4.9.118 (December 8, 2025) restricts
cross-origin requests to localhost aliases, IP addresses, hosts with ports and non-HTTPS resources. The
absolute majority of users have received an update 4.1.117 or 4.9.118 automatically within a week. However
users must ensure their automatic updates are not blocked and they are using the latest version of the
extension by going to chrome://extensions or about:addons pages in browser settings. Users utilizing
manual builds must upgrade to version 4.9.118 and above. Developers using `darkreader` NPM package for
their own websites are likely not affected, but must ensure the function passed to `setFetchMethod()` for
performing cross-origin requests works within the intended scope. Developers using custom forks of earlier
versions of Dark Reader to build other extensions or integrating into their apps or browsers must ensure
they perform cross-origin requests safely and the responses are not accessible outside of the app or
extension. (CVE-2025-68467)
See Also
Plugin Details
Severity: Low
ID: 438334
Version: Revision 1.11
Type: Local
Family: SCA Checks
Published: 3/5/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 2.6
Temporal Score: 1.9
Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2025-68467
CVSS v3
Risk Factor: Low
Base Score: 3.4
Temporal Score: 3
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 3/4/2026
Vulnerability Publication Date: 3/4/2026
Reference Information
CVE: CVE-2025-68467