CVE-2025-66402: misskey.js Exposes Private Post Data through Export Functionality
Summary
CVE-2025-66402: misskey.js's export data contains private post data. Affects misskey-js versions >= 13.0.0-beta.16, < 2025.12.0. Fixed in 2025.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
misskey.js is a JavaScript library designed for interacting with the Misskey platform, a decentralized social media service. The library allows users to manage their accounts, posts, and interactions seamlessly. However, a critical vulnerability has been identified that enables unauthorized access to private posts when users export their favorites or clips, potentially compromising user privacy.
Vulnerability Detail
The vulnerability arises from the ability to add private posts, which users do not have permission to view, to their favorites or clips. When these favorites or clips are exported, the contents of the private posts become accessible to the user who initiated the export. This flaw can lead to significant privacy breaches, as attackers can exploit this functionality to view sensitive information that should remain confidential.
How To Fix
Latest published version: 2026.10.1-alpha.1 as of 23 Oct 2026
npm install misskey-js@2026.10.1-alpha.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2025.12.0
This is the first release that contains the fix.
npm install misskey-js@2025.12.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should refrain from adding private posts to their favorites or clips until the package is updated. This will help prevent unauthorized access to sensitive information while a permanent fix is being implemented.
Conclusion
The CVE-2025-66402 vulnerability in the misskey.js library poses a significant risk by allowing unauthorized access to private post data. It is crucial for users to update to the patched version 2025.12.0 to safeguard their privacy and prevent potential data breaches. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for misskey-js →
FAQ
CVE-2025-66402 is a vulnerability in the misskey.js library that allows unauthorized access to private post data when users export their favorites or clips.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized access to private posts, compromising user privacy and potentially exposing sensitive information.
You can update the misskey-js package by running the command 'npm install misskey-js@2025.12.0' in your terminal.
Yes, as a temporary measure, avoid adding private posts to your favorites or clips until the package is updated to prevent unauthorized access.
References
Related vulnerabilities
Recent vulnerabilities recorded for misskey-js.
