Baileys processes a fabricated payload received through the placeholderResendMessage function, causing the library to emit a fake messages.upsert event that contains a counterfeit message key and contents. This flaw enables an attacker to make the Baileys session believe it has received legitimate messages, thereby allowing message spoofing, injecting false message history, and corrupting the app state synchronization system. The impact includes unauthorized impersonation of participants, delivery of deceptive content, and potential loss of data integrity for the user’s chat history.

The problem exists in the WhatsApp Web JavaScript/TypeScript API known as Baileys, provided by WhiskeySockets. Any version prior to 6.7.22 and before 7.0.0-rc12 is affected; the fix was released in those two specific releases.

The CVSS score of 9.3 flags this a critical vulnerability. No EPSS score is available, so the exploit probability cannot be quantified, and the vulnerability is not yet listed in the CISA KEV catalog. Inferred from the description, the attack vector likely requires access to a Baileys session that can inject arbitrary protocolMessage payloads via placeholderResendMessage or history sync requests. Successful exploitation could permit an attacker to inject malicious messages and corrupt session state.