PT-2025-39318 · Unknown · Counterpart

Published 2025-09-24 · Updated 2025-09-27 · CVE-2025-57354

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions counterpart versions prior to 0.18.6

Description A flaw exists in the 'counterpart' library for Node.js and the browser because of inadequate sanitization of user-controlled input during translation key processing. Insufficient validation of translation keys allows attackers to manipulate the library’s functionality by supplying maliciously crafted keys containing prototype chain elements, such as proto, leading to prototype pollution. This enables adversaries to inject arbitrary properties into the JavaScript Object prototype through the first parameter of the translate method when used with specific separator configurations. This can potentially result in denial-of-service conditions or remote code execution in vulnerable applications.

Recommendations Update to counterpart version 0.18.6 or later.

Exploit

Fix

DoS

RCE

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-57354

GHSA-2488-W585-72CH

Affected Products

Counterpart

References · 10

• 🔥 https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57354 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57354 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57354 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2488-w585-72ch · Vendor Advisory
• https://github.com/martinandert/counterpart · Note
• https://github.com/martinandert/counterpart/issues/54 · Note
• https://twitter.com/VulmonFeeds/status/1971097404578337016 · Twitter Post
• https://twitter.com/CVEnew/status/1970996108349538786 · Twitter Post
• https://t.me/CVEtracker/33277 · Telegram Post
• https://twitter.com/SecAideInfo/status/1971880716406333836 · Twitter Post