Skip to main content

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CVE-2025-57353

Medium
5.3/10

Summary

in version through 3.0.1,the Runtime components of the messageformat package for Node.js contain a Prototype Pollution vulnerability. Due to insufficient validation of nested message keys during processing of message data, an attacker can manipulate the prototype chain of JavaScript objects by providing specially crafted input. This can result in the injection of arbitrary properties into "Object.prototype", potentially leading to denial of service conditions or unexpected application behavior. The vulnerability allows attackers to alter the prototype of base objects, impacting all subsequent object instances throughout the application's lifecycle. This issue remains unaddressed in the latest available version.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-1321 - Prototype Pollution

Prototype pollution is one of the lesser-known vulnerabilities. It allows attackers to abuse the rules of JavaScript by injecting properties into the general object “Object” in JS. Modifying the prototype of “Object” affects the behavior of all objects in the entire app, potentially resulting in denial of service, arbitrary code execution, cross-site scripting, etc.

References

Advisory Timeline

  • Published