CVE-2026-25204

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-13 · updated 2026-10-26
Weakness: CWE-502

Description

Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process abort. This issue affects escarogt prior to commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335

Affected products

Samsung Open Source Escargot: before 2026-03-28 — fixed in 2026-03-28

How to fix

Upgrade to a fixed version: Samsung Open Source Escargot 2026-03-28. Check the vendor advisory for mitigations.

References

https://github.com/Samsung/escargot/pull/1554

Get alerted when CVE-2026-25204 or the next vulnerability affects your stack