Vulnerability in Whiskeysockets Baileys
CVE-2026-48063
Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event w…
Affected products
- Whiskeysockets Baileys — versions < 6.7.22, >= 7.0.0-rc.1, < 7.0.0-rc12
- Whiskeysockets @Whiskeysockets/baileys — versions < 6.7.22, >= 7.0.0-rc.1, < 7.0.0-rc12
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM)