PT-2025-39317 · Node.Js · Messageformat

CVE-2025-57353 · Publicado 2025-09-24 · Atualizado 2025-10-31

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions messageformat versions prior to 3.0.2

Description The Runtime components of the messageformat package for Node.js are susceptible to a prototype pollution issue. Insufficient validation of nested message keys during message data processing allows an attacker to manipulate the JavaScript object prototype chain with specially crafted input. This manipulation can lead to the injection of arbitrary properties into the Object.prototype, potentially causing denial of service or unexpected application behavior. The issue allows attackers to alter the prototype of base objects, impacting all subsequent object instances throughout the application's lifecycle.

Recommendations Update to messageformat version 3.0.2 or later.

Exploit

Correção

DoS

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CVE-2025-57353

GHSA-6XV4-9CQP-92RH

Produtos afetados

Messageformat

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57353.json · Exploit
• 🔥 https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57353 · Exploit
• https://github.com/messageformat/messageformat/commit/82cd10b40e3f922f990bbcf88a6d14b70c0a3ce0 · Nota
• https://github.com/messageformat/messageformat/issues/453#issuecomment-3466959449 · Nota
• https://github.com/messageformat/messageformat/pull/464 · Nota
• https://github.com/messageformat/messageformat/issues/453 · Nota
• https://github.com/messageformat/messageformat · Nota
• https://t.me/CVEtracker/33276 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1970996107368149267 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-57353 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1971099964441874937 · Publicação no Twitter
• https://t.me/cveNotify/141067 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-57353 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-6xv4-9cqp-92rh · Aviso do Fabricante