{"id":"CVE-2025-45806","details":"A cross-site scripting (XSS) vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.","modified":"2026-07-15T01:49:09.880588140Z","published":"2026-04-09T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/45xxx/CVE-2025-45806.json"},"references":[{"type":"WEB","url":"https://github.com/rrweb-io/rrweb/tree/master/packages/rrweb-snapshot"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/45xxx/CVE-2025-45806.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-45806"},{"type":"REPORT","url":"https://github.com/rrweb-io/rrweb/issues/1817"},{"type":"PACKAGE","url":"https://github.com/rrweb-io/rrweb"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rrweb-io/rrweb","events":[{"introduced":"0"},{"fixed":"1db7a99ff32b1c826b44d82e7dda9303a49e1fb3"}],"database_specific":{"source":"DESCRIPTION","extracted_events":[{"introduced":"0"},{"fixed":"v2.0.0-alpha.18"}]}}],"versions":["rrweb@2.0.0-alpha.17","rrweb-snapshot@2.0.0-alpha.17","rrweb-player@2.0.0-alpha.17","rrvideo@2.0.0-alpha.17","rrdom@2.0.0-alpha.17","rrdom-nodejs@2.0.0-alpha.17","@rrweb/utils@2.0.0-alpha.17","@rrweb/types@2.0.0-alpha.17","@rrweb/rrweb-plugin-sequential-id-replay@2.0.0-alpha.17","@rrweb/rrweb-plugin-sequential-id-record@2.0.0-alpha.17","@rrweb/rrweb-plugin-console-replay@2.0.0-alpha.17","@rrweb/rrweb-plugin-console-record@2.0.0-alpha.17","@rrweb/rrweb-plugin-canvas-webrtc-replay@2.0.0-alpha.17","@rrweb/rrweb-plugin-canvas-webrtc-record@2.0.0-alpha.17","@rrweb/replay@2.0.0-alpha.17","@rrweb/record@2.0.0-alpha.17","@rrweb/packer@2.0.0-alpha.17","@rrweb/all@2.0.0-alpha.17","rrweb@2.0.0-alpha.16","rrweb-snapshot@2.0.0-alpha.16","rrweb-player@2.0.0-alpha.16","rrvideo@2.0.0-alpha.16","rrdom@2.0.0-alpha.16","rrdom-nodejs@2.0.0-alpha.16","@rrweb/types@2.0.0-alpha.16","rrweb@2.0.0-alpha.15","rrweb-snapshot@2.0.0-alpha.15","rrweb-player@2.0.0-alpha.15","rrvideo@2.0.0-alpha.15","rrdom@2.0.0-alpha.15","rrdom-nodejs@2.0.0-alpha.15","@rrweb/types@2.0.0-alpha.15","@rrweb/rrweb-plugin-sequential-id-replay@2.0.0-alpha.15","@rrweb/rrweb-plugin-sequential-id-record@2.0.0-alpha.15","@rrweb/rrweb-plugin-console-replay@2.0.0-alpha.15","@rrweb/rrweb-plugin-console-record@2.0.0-alpha.15","@rrweb/rrweb-plugin-canvas-webrtc-replay@2.0.0-alpha.15","@rrweb/rrweb-plugin-canvas-webrtc-record@2.0.0-alpha.15","@rrweb/replay@2.0.0-alpha.15","@rrweb/record@2.0.0-alpha.15","@rrweb/packer@2.0.0-alpha.15","@rrweb/all@2.0.0-alpha.15","rrweb@2.0.0-alpha.14","rrweb-snapshot@2.0.0-alpha.14","rrweb-player@2.0.0-alpha.14","rrvideo@2.0.0-alpha.14","rrdom@2.0.0-alpha.14","rrdom-nodejs@2.0.0-alpha.14","@rrweb/types@2.0.0-alpha.14","rrweb@2.0.0-alpha.13","rrweb-snapshot@2.0.0-alpha.13","rrweb-player@2.0.0-alpha.13","rrvideo@2.0.0-alpha.13","rrdom@2.0.0-alpha.13","rrdom-nodejs@2.0.0-alpha.13","@rrweb/types@2.0.0-alpha.13","rrweb@2.0.0-alpha.12","rrweb-snapshot@2.0.0-alpha.12","rrweb-player@2.0.0-alpha.12","rrvideo@2.0.0-alpha.12","rrdom@2.0.0-alpha.12","rrdom-nodejs@2.0.0-alpha.12","@rrweb/types@2.0.0-alpha.12","rrweb@2.0.0-alpha.11","rrweb-snapshot@2.0.0-alpha.11","rrweb-player@2.0.0-alpha.11","rrvideo@2.0.0-alpha.11","rrdom@2.0.0-alpha.11","rrdom-nodejs@2.0.0-alpha.11","@rrweb/types@2.0.0-alpha.11","rrweb@2.0.0-alpha.10","rrweb-snapshot@2.0.0-alpha.10","rrweb-player@2.0.0-alpha.10","rrvideo@2.0.0-alpha.10","rrdom@2.0.0-alpha.10","rrdom-nodejs@2.0.0-alpha.10","@rrweb/types@2.0.0-alpha.10","rrweb@2.0.0-alpha.9","rrweb-snapshot@2.0.0-alpha.9","rrweb-player@2.0.0-alpha.9","rrvideo@2.0.0-alpha.9","rrdom@2.0.0-alpha.9","rrdom-nodejs@2.0.0-alpha.9","@rrweb/types@2.0.0-alpha.9","rrweb@2.0.0-alpha.8","rrweb-snapshot@2.0.0-alpha.8","rrweb-player@2.0.0-alpha.8","rrvideo@2.0.0-alpha.8","rrdom@2.0.0-alpha.8","rrdom-nodejs@2.0.0-alpha.8","@rrweb/types@2.0.0-alpha.8","rrweb@2.0.0-alpha.7","rrweb-snapshot@2.0.0-alpha.7","rrweb-player@2.0.0-alpha.7","rrvideo@2.0.0-alpha.7","rrdom@2.0.0-alpha.7","rrdom-nodejs@2.0.0-alpha.7","@rrweb/types@2.0.0-alpha.7","rrweb@2.0.0-alpha.6","rrweb-snapshot@2.0.0-alpha.6","rrweb-player@2.0.0-alpha.6","rrdom@2.0.0-alpha.6","rrdom-nodejs@2.0.0-alpha.6","@rrweb/types@2.0.0-alpha.6","rrweb@2.0.0-alpha.5","rrweb-snapshot@2.0.0-alpha.5","rrweb-player@2.0.0-alpha.5","rrdom@2.0.0-alpha.5","rrdom-nodejs@2.0.0-alpha.5","@rrweb/types@2.0.0-alpha.5","rrweb@2.0.0-alpha.4","rrweb-snapshot@2.0.0-alpha.4","rrweb-player@1.0.0-alpha.4","rrdom@0.1.7","rrdom-nodejs@0.1.7","@rrweb/types@2.0.0-alpha.4","rrweb@2.0.0-alpha.3","rrweb-snapshot@2.0.0-alpha.3","rrweb-player@1.0.0-alpha.3","rrdom@0.1.6","rrdom-nodejs@0.1.6","rrweb@2.0.0-alpha.2","rrweb-snapshot@2.0.0-alpha.2","rrweb-player@1.0.0-alpha.2","rrdom@0.1.5","rrdom-nodejs@0.1.5","rrweb@2.0.0-alpha.1","rrweb-snapshot@2.0.0-alpha.1","rrweb-player@1.0.0-alpha.1","rrdom@0.1.4","rrdom-nodejs@0.1.4","rrweb@2.0.0-alpha.0","rrweb-snapshot@2.0.0-alpha.0","rrweb-player@1.0.0-alpha.0","rrdom@0.1.3","rrdom-nodejs@0.1.3","rrweb@1.1.3","rrweb-snapshot@1.1.14","rrweb-player@0.7.14","rrdom@0.1.2","rrweb@1.1.2","rrweb-snapshot@1.1.13","rrweb-player@0.7.13","rrdom@0.1.1","rrweb@1.1.1","rrweb-player@0.7.12","rrweb@1.1.0","rrweb-snapshot@1.1.12","rrweb-player@0.7.11","rrdom@0.1.0","rrweb@1.0.8","rrweb-snapshot@1.1.11","rrweb-player@0.7.10","rrweb@1.0.7","rrweb-snapshot@1.1.10","rrweb-player@0.7.9","rrweb@1.0.6","rrweb-snapshot@1.1.9","rrweb-player@0.7.8","rrweb@1.0.5","rrweb-player@0.7.7","rrweb@1.0.4","rrweb-player@0.7.6","rrweb@1.0.3","rrweb-snapshot@1.1.8","rrweb-player@0.7.5","1.0.2","1.0.1","1.0.0","1.0.0-beta.2","1.0.0-beta.1","1.0.0-beta.0","0.9.14","0.9.13","0.9.12","0.9.11","0.9.10","0.9.9","0.9.8","0.9.7","0.9.6","0.9.5","0.9.4","0.9.3","0.9.2","0.9.1","0.9.0","0.8.5","0.8.4","0.8.3","0.8.2","0.8.1","0.8.0","0.7.33","0.7.32","0.7.31","0.7.30","0.7.29","0.7.28","0.7.27","0.7.26","0.7.25","0.7.24","0.7.23","0.7.22","0.7.21","0.7.20","0.7.19","0.7.18","0.7.17","0.7.16","0.7.15","0.7.14","0.7.13","0.7.12","0.7.11","0.7.10","0.7.9","0.7.8","0.7.7","0.7.6","0.7.5","0.7.4","0.7.3","0.7.2","0.7.1","0.7.0","0.6.12","0.6.11","0.6.10","0.6.9","0.6.8","0.6.7","0.6.6","0.6.5","0.6.4","0.6.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-45806.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}