Platform
java
Component
litemall
Fixed in
1.8.1
CVE-2025-6702 is a supply chain vulnerability affecting versions 99.1.1–99.1.1 of the build-angular package. This issue arises from the package's communication with a domain identified as being associated with malicious activity, posing a risk of compromised dependencies. The vulnerability was published on 2025-07-30, and mitigation strategies are recommended until a patched version becomes available.
The core impact of CVE-2025-6702 lies in the potential for supply chain compromise. An attacker controlling the malicious domain could inject malicious code into the build-angular package, which would then be incorporated into applications using it. This could lead to arbitrary code execution within the application's build process, allowing the attacker to compromise the application and potentially the underlying system. The blast radius extends to any application relying on the vulnerable build-angular version, making this a widespread concern. This is similar to other dependency confusion attacks where attackers exploit package naming conventions to inject malicious packages.
CVE-2025-6702 is a relatively recent discovery, published on 2025-07-30. Its inclusion in the Node Package Manager (npm) registry highlights the importance of supply chain security. Public proof-of-concept exploits are not currently available, but the potential for exploitation is considered medium due to the ease of injecting malicious code into a dependency. The EPSS score is pending evaluation. Monitor npm and security advisories for updates.
Exploit Status
EPSS
0.11% (29% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-6702 is to upgrade to a patched version of build-angular as soon as it becomes available. Until a patch is released, several workarounds can be implemented. First, restrict network access for the build process to only trusted domains. This can be achieved through firewall rules or proxy configurations. Second, implement stricter dependency verification measures, such as using software composition analysis (SCA) tools to scan dependencies for known vulnerabilities and malicious domains. Third, consider temporarily removing build-angular from your project and exploring alternative build tools if feasible. After implementing these measures, verify the build process is no longer attempting to communicate with the malicious domain using network monitoring tools.
Actualizar a una versión posterior a la 1.8.0, si existe, donde se haya corregido la vulnerabilidad de autorización. Si no hay una versión corregida disponible, revisar y modificar el código en `/wx/comment/post` para asegurar una correcta validación de los permisos antes de permitir la manipulación del argumento `adminComment`.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-6702 is a vulnerability in build-angular where the package communicates with a domain linked to malicious activity, potentially leading to supply chain attacks.
If you are using build-angular versions 99.1.1–99.1.1, you are potentially affected. Check your project dependencies immediately.
Upgrade to a patched version of build-angular as soon as it's available. Until then, restrict network access and implement dependency verification.
There are no confirmed active exploits currently, but the potential for exploitation is considered medium.
Refer to the npm security advisories and the build-angular project's official communication channels for updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your pom.xml file and we'll tell you instantly if you're affected.