Baileys (WhatsApp library) message spoofing and app state corruption via malicious protocolMessage payload
critical-cve-against-dependency · active
The Baileys npm library (a WhatsApp Web API client) is vulnerable to message spoofing, history sync spoofing, and app state sync corruption when sent a maliciously crafted protocolMessage payload. Anyone can spoof messages.upsert events with fake keys and payloads. Fixed in 7.0.0-rc12 and 6.7.22.
Affected packages
- npmbaileys