PT-2025-39316 · Unknown+1 · Min-Document+1

Published 2025-09-24 · Updated 2025-09-25 · CVE-2025-57352

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions min-document versions prior to 2.19.0

Description A flaw exists in the 'min-document' package due to improper handling of namespace operations within the removeAttributeNS function. An attacker can exploit this by manipulating the prototype chain of JavaScript objects through malicious input involving the proto property. This manipulation can lead to denial of service or arbitrary code execution, resulting from insufficient validation of attribute namespace removal operations and allowing unintended modification of critical object prototypes.

Recommendations Update to version 2.19.0 or later.

Exploit

Fix

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-57352

GHSA-RX8G-88G5-QH64

Affected Products

Debian

Min-Document

References · 16

• 🔥 https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57352 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57352 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-57352 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-57352 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-57352 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-57352 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rx8g-88g5-qh64 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-57352 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-57352 · Security Note
• https://github.com/Raynos/min-document/issues/54 · Note
• https://github.com/Raynos/min-document/pull/55 · Note
• https://github.com/Raynos/min-document/commit/fe32e8da464cef622528725f647029a8fd7d95a6 · Note
• https://github.com/Raynos/min-document · Note
• https://twitter.com/VulmonFeeds/status/1971105084223213901 · Twitter Post
• https://twitter.com/CVEnew/status/1970996106382512494 · Twitter Post