CVE-2025-27611CWE-1007

base-x homograph attack allows Unicode lookalike characters to bypass validation.

High · published April 30, 2025

CVSS v4.0
8.7
EPSS
0%
Percentile
35.8
In the wild
Unconfirmed
What it is

base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This issue has been patched in versions 3.0.11, 4.0.1, and 5.0.1.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00427 · 35.8th percentile
Weakness
CWE-1007 · Insufficient Visual Distinction of Homoglyphs Presented to User
Published
2025-04-30T19:36Z
EPSS history
Timeline
  • 30 APR 19:36Z
    base-x homograph attack allows Unicode lookalike characters to bypass validation.
    cvelistv5