High severity · published Jul 5, 2025
CVE-2025-7074
A vulnerability classified as problematic has been found in vercel hyper up to 3.4.1
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability classified as problematic has been found in vercel hyper up to 3.4.1. This affects the function expand/braceExpand/ignoreMap of the file hyper/bin/rimraf-standalone.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HY
Hyper · Vercel
through 3.4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7074
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7074
Exploit
https://github.com/vercel/hyper/issues/8098
Permissions Required
https://vuldb.com/?ctiid.314973
Third Party Advisory
https://vuldb.com/?id.314973
Third Party Advisory
https://vuldb.com/?submit.602353
More from Hyper
9.8
CVE-2024-23741
An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings