CVE-2025-47425
Reflex vulnerable to private state fields modification
Summary
A user on the website can modify any private field on their own state.
Details
An event meant to modify client side storage had access to modify any field on the state for the given user. This includes non-client side ones and most importantly private fields. This still requires the actor to guess the name for the private fields.
Impact
If one of the States in your app can be modified to allow the user into a different role or a different user this allows the actor to act as someone else or as admin.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
What each source reports
GitHub Advisories Score usedGHSA-rf8x-9mhr-49wg
Reflex vulnerable to private state fields modification
Summary
A user on the website can modify any private field on their own state.
Details
An event meant to modify client side storage had access to modify any field on the state for the given user. This includes non-client side ones and most importantly private fields. This still requires the actor to guess the name for the private fields.
Impact
If one of the States in your app can be modified to allow the user into a different role or a different user this allows the actor to act as someone else or as admin.
- Record
GHSA-rf8x-9mhr-49wg- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
reflexPyPI |
0.2.7 up to 0.4.9.post1 | 0.4.9.post1 |
reflexPyPI |
Source text: > 0.4.9.post1, < 0.5.10.post1 | 0.5.10.post1Not evaluated |
reflexPyPI |
Source text: > 0.5.10.post1, < 0.6.8.post1 | 0.6.8.post1Not evaluated |
reflexPyPI |
Source text: > 0.6.8.post1, < 0.7.1.post1 | 0.7.1.post1Not evaluated |
reflexPyPI |
Source text: > 0.7.1.post1, < 0.7.2.post1 | 0.7.2.post1Not evaluated |
reflexPyPI |
Source text: > 0.7.2.post1, < 0.7.3.post1 | 0.7.3.post1Not evaluated |
reflexPyPI |
Source text: > 0.7.3.post1, < 0.7.4.post1 | 0.7.4.post1Not evaluated |
reflexPyPI |
Source text: > 0.7.4.post1, < 0.7.5.post1 | 0.7.5.post1Not evaluated |
reflexPyPI |
Source text: > 0.7.5.post1, < 0.7.6.post1 | 0.7.6.post1Not evaluated |
reflexPyPI |
Source text: > 0.7.6.post1, < 0.7.7.post1 | 0.7.7.post1Not evaluated |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
reflexPyPI |
Source text: > 0.7.7.post1, < 0.7.8.post1 | 0.7.8.post1Not evaluated |
reflexPyPI |
Source text: > 0.7.8.post1, < 0.7.9.post1 | 0.7.9.post1Not evaluated |
reflexPyPI |
Source text: > 0.7.9.post1, < 0.7.10.post1 | 0.7.10.post1Not evaluated |
reflexPyPI |
Source text: > 0.7.10.post1, < 0.7.11 | 0.7.11Not evaluated |
Not evaluated means the source gave git commits or a range we can't read, so we can't tell which releases are affected. A fixed version beside it is the source’s own claim.
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-47425 is a high vulnerability (CVSS 8.1) in reflex, published May 15, 2025. No source lists public exploit code. Fixed in reflex 0.4.9.post1.