// For flags

CVE-2025-54883

Vision UI's security-kit Contains Cryptographic Weakness

Severity Score

9.3
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

Vision UI is a collection of enterprise-grade, dependency-free modules for modern web projects. In versions 1.4.0 and below, the getSecureRandomInt function in security-kit versions prior to 3.5.0 (packaged in Vision-ui <= 1.4.0) contains a critical cryptographic weakness. Due to a silent 32-bit integer overflow in its internal masking logic, the function fails to produce a uniform distribution of random numbers when the requested range between min and max is larger than 2³². The root cause is the use of a 32-bit bitwise left-shift operation (<<) to generate a bitmask for the rejection sampling algorithm. This causes the mask to be incorrect for any range requiring 32 or more bits of entropy. This issue is fixed in version 1.5.0.

Vision UI es una colección de módulos empresariales sin dependencias para proyectos web modernos. En las versiones 1.4.0 y anteriores, la función getSecureRandomInt de las versiones del kit de seguridad anteriores a la 3.5.0 (incluidas en Vision-ui &lt;= 1.4.0) presenta una vulnerabilidad criptográfica crítica. Debido a un desbordamiento silencioso de enteros de 32 bits en su lógica de enmascaramiento interna, la función no genera una distribución uniforme de números aleatorios cuando el rango solicitado entre min y max es mayor que 2³². La causa principal es el uso de una operación de desplazamiento a la izquierda bit a bit de 32 bits (&lt;&lt;) para generar una máscara de bits para el algoritmo de muestreo de rechazo. Esto provoca que la máscara sea incorrecta para cualquier rango que requiera 32 bits o más de entropía. Este problema se solucionó en la versión 1.5.0.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
System
Vulnerable | Subsequent
Confidentiality
High
Low
Integrity
High
Low
Availability
None
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2025-07-31 CVE Reserved
  • 2025-08-05 CVE Published
  • 2025-08-06 CVE Updated
  • 2025-08-11 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
DavidOsipov
Search vendor "DavidOsipov"
 Vision-ui
Search vendor "DavidOsipov" for product "Vision-ui"
 < 1.5.0
Search vendor "DavidOsipov" for product "Vision-ui" and version " < 1.5.0"
en
Affected