What is CVE-2025-68467?

CVE-2025-68467 is a low-severity security vulnerability in darkreader (npm), affecting versions < 4.9.117. It is fixed in 4.9.117.

How severe is CVE-2025-68467?

CVE-2025-68467 has a CVSS score of 3.4 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Which versions of darkreader are affected by CVE-2025-68467?

darkreader (npm) versions < 4.9.117 is affected.

Is there a fix for CVE-2025-68467?

Yes. CVE-2025-68467 is fixed in 4.9.117. Upgrade to this version or later.

Is CVE-2025-68467 exploitable, and should I be worried?

Whether CVE-2025-68467 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2025-68467 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2025-68467?

Upgrade darkreader to 4.9.117 or later.

CVE-2025-68467 in darkreader

Q: How severe is CVE-2025-68467?

CVE-2025-68467 has a CVSS score of 3.4 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.

Q: Which versions of darkreader are affected by CVE-2025-68467?

darkreader (npm) versions < 4.9.117 is affected.

Q: Is there a fix for CVE-2025-68467?

Yes. CVE-2025-68467 is fixed in 4.9.117. Upgrade to this version or later.

Q: Is CVE-2025-68467 exploitable, and should I be worried?

Whether CVE-2025-68467 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2025-68467 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2025-68467?

Upgrade darkreader to 4.9.117 or later.

Summary

Dark Reader gives users the ability to request style sheets from local web servers

Description

Dark Reader versions prior to 4.9.117 included a behavior where a website could request a style sheet from a locally running web server, for example http://localhost:8080/style.css, If an address was available and returned a text/css content type.

NPM package

The issue does not affect developers using the darkreader NPM package for website integration. Developers using the setFetchMethod() API must ensure the cross-origin requests are restricted to the intended scope.

Custom forks

Developers using custom forks of earlier versions of Dark Reader to build other extensions, or integrating it into their apps or browsers, should review their implementation to ensure cross-origin requests are handled securely.

Acknowledgements

Security research performed by Brian Carpenter - Deep Fork Cyber.

Impact

CVE-2025-68467 has a CVSS score of 3.4 (Low). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.9.117); upgrading removes the vulnerable code path.

Affected versions

darkreader (< 4.9.117)

Security releases

darkreader → 4.9.117 (npm)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

The problem was fixed in version 4.9.117, released on December 3, 2025. Most users received the update automatically. Users running manual builds must upgrade to version 4.9.117 or later.

The installed extension version number can be verified in Dark Reader's menu (More > All settings > About), browser settings, chrome://extensions or about:addons pages.

Users are encouraged not to disable automatic extension updates and use the latest browser version, as browser releases typically include multiple security fixes of varying severity.

Frequently Asked Questions

What is CVE-2025-68467? CVE-2025-68467 is a low-severity security vulnerability in darkreader (npm), affecting versions < 4.9.117. It is fixed in 4.9.117.
How severe is CVE-2025-68467? CVE-2025-68467 has a CVSS score of 3.4 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
Which versions of darkreader are affected by CVE-2025-68467? darkreader (npm) versions < 4.9.117 is affected.
Is there a fix for CVE-2025-68467? Yes. CVE-2025-68467 is fixed in 4.9.117. Upgrade to this version or later.
Is CVE-2025-68467 exploitable, and should I be worried? Whether CVE-2025-68467 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2025-68467 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2025-68467? Upgrade darkreader to 4.9.117 or later.