CVE-2026-48063Critical▾ MidnightBaileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.2%
Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event with a fake message key and payload. This allows anyone to spoof messages. The same exploit also allows an attacker to corrupt the app state sync system by sending fake key shares, and also allows for history sync spoofing which also serves the same problem, injecting fake previous context or "on-demand" sync. This issue has been fixed in versions 6.7.22 and 7.0.0-rc12.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
baileys < 6.7.22@whiskeysockets/baileys < 6.7.22baileys >= 7.0.0-rc.1, < 7.0.0-rc12@whiskeysockets/baileys >= 7.0.0-rc.1, < 7.0.0-rc12Patched in:
baileys 6.7.22@whiskeysockets/baileys 6.7.22baileys 7.0.0-rc12@whiskeysockets/baileys 7.0.0-rc12Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86039High· 8.2libp2p is a JavaScript implementation of the libp2p networking stack
CVE-2026-115933Critical· 9.9Forged signed tokens let any registered user take over other users and organizations
CVE-2026-114612Critical· 9.9LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
CVE-2026-102946Critical· 9.1joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards
CVE-2026-104108High· 8.1FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
CVE-2026-62367High· 7.5Vikunja is an open-source self-hosted task management platform