CVE-2025-32792: SES JavaScript Compartment XSS Vulnerability

CVE-2025-32792 Overview

CVE-2025-32792 affects SES (Secure ECMAScript), a JavaScript library that executes third-party code inside isolated compartments. Versions prior to 1.12.0 inadvertently expose top-level let, const, and class bindings from <script> tags into the lexical scope of third-party code running inside a Compartment. The flaw breaks the isolation guarantee that web pages and web extensions rely on when sandboxing untrusted JavaScript. Attackers controlling the third-party code can read host application bindings that were intended to remain private. The maintainers patched the issue in SES version 1.12.0.

Critical Impact
Third-party JavaScript executed inside an SES Compartment can read top-level let, const, and class bindings from the embedding page, defeating the sandbox's confidentiality guarantee.

Affected Products

Endo SES (ses npm package) versions prior to 1.12.0
Web pages embedding SES with Compartment API for third-party code evaluation
Web extensions using SES to isolate untrusted JavaScript execution

Discovery Timeline

2025-04-18 - CVE-2025-32792 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-32792

Vulnerability Analysis

SES safely executes third-party JavaScript strict mode programs inside compartments with no excess authority in their global scope. The Compartment API is the primary isolation primitive that hosting applications use to evaluate untrusted code. The vulnerability stems from how the JavaScript engine treats top-level let, const, and class declarations in a <script> tag.

Unlike var declarations, which attach to the global object (globalThis), let, const, and class bindings live in a separate top-level lexical environment. SES did not account for that environment when constructing the lexical scope chain visible to compartment code. As a result, untrusted code evaluated inside a Compartment could resolve identifiers that referenced the host script's private bindings. The weakness maps to [CWE-497]: Exposure of Sensitive System Information to an Unauthorized Control Sphere.

Root Cause

The root cause is incomplete scope isolation between the host realm's script-level lexical environment and the compartment's evaluator. SES interposed on globalThis access but did not block name resolution into the outer script's let, const, and class declarations. Any identifier reference inside compartment code that did not shadow a local binding fell through to the embedding script's lexical scope.

Attack Vector

An attacker supplies JavaScript that the host application evaluates inside a Compartment, expecting full isolation. The attacker code references identifier names matching variables, constants, or class names declared at the top level of the host's <script> tag. The JavaScript engine resolves those references to the host's private bindings, exposing values such as authentication tokens, API keys, cryptographic material, or internal state. Exploitation requires no authentication and no user interaction beyond loading the page that hosts the vulnerable SES integration.

No public proof-of-concept exploit is available. The vulnerability mechanism is documented in the Endo Security Advisory GHSA-h9w6-f932-gq62.

Detection Methods for CVE-2025-32792

Indicators of Compromise

Third-party scripts inside a Compartment referencing identifier names that match host-side let, const, or class declarations
Outbound network requests from compartment code carrying values that should only exist in the host script's lexical scope
SES package version reported as less than 1.12.0 in build manifests or package-lock.json

Detection Strategies

Audit dependency manifests for ses versions below 1.12.0 across web applications and browser extensions
Static analysis of host <script> tags to identify top-level let, const, and class declarations that could leak through SES
Review compartment evaluation call sites and inspect the identifier names referenced by third-party bundles

Monitoring Recommendations

Track Software Composition Analysis (SCA) findings for the ses package and alert on installs of versions prior to 1.12.0
Monitor browser extension update channels for builds that ship vulnerable SES versions
Log and review compartment evaluation errors and unexpected identifier resolutions during application testing

How to Mitigate CVE-2025-32792

Immediate Actions Required

Upgrade the ses package to version 1.12.0 or later in all affected web applications and extensions
Inventory every call site that constructs a Compartment and confirm the host script does not declare sensitive values at the top level
Rebuild and redeploy any web extension bundles that statically include vulnerable SES versions

Patch Information

The Endo maintainers fixed the issue in SES version 1.12.0. Refer to the GitHub Security Advisory GHSA-h9w6-f932-gq62 for patch details and release notes. Update package.json to require ses@^1.12.0 and refresh lockfiles before redeployment.

Workarounds

Avoid declaring top-level let, const, or class bindings in any <script> tag that also loads SES
Convert existing top-level let and const declarations to var so the bindings attach to globalThis and remain governed by the compartment's global isolation
Move sensitive state into module scope or closures that are never referenced from a script that instantiates a Compartment

bash

# Upgrade SES to the patched release
npm install ses@^1.12.0
npm ls ses