CVE-2025-57352: Medium severity min-document min-document vulnerability
A vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in the removeAttributeNS method. By processing malicious input involving the proto property, an attacker can manipulate the prototype chain of JavaScript objects, leading to denial of service or arbitrary code execution. This issue arises from insufficient validation of attribute namespace removal operations, allowing unintended modification of critical object prototypes. The vulnerability remains unaddressed in the latest available version.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57352?
CVE-2025-57352 is considered a medium severity vulnerability due to its potential for prototype pollution in JavaScript applications.
How do I fix CVE-2025-57352?
To fix CVE-2025-57352, upgrade the 'min-document' package to version 2.19.0 or later.
What does CVE-2025-57352 exploit in the 'min-document' package?
CVE-2025-57352 exploits improper handling of namespace operations in the removeAttributeNS method.
Which versions of 'min-document' are affected by CVE-2025-57352?
Versions of 'min-document' prior to 2.19.0 are affected by CVE-2025-57352.
What are the potential impacts of CVE-2025-57352?
The potential impacts of CVE-2025-57352 include an attacker being able to manipulate the prototype chain of JavaScript objects, leading to various security issues.