PT-2025-39330 · Unknown · Messageformat

Published 2025-09-24 · Updated 2025-10-17 · CVE-2025-57349

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions messageformat versions prior to 2.3.0

Description The messageformat package, a JavaScript implementation of the Unicode MessageFormat 2 specification, contains a flaw related to improper handling of message key paths. This can lead to prototype pollution when processing nested message keys with special characters, such as proto. A remote attacker could potentially inject properties into the global object prototype using specially crafted message input, which may result in denial of service or other unpredictable behavior in applications utilizing the component.

Recommendations Update to version 2.3.0 or later.

Fix

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-57349

GHSA-XFQM-J7PC-XRFC

Affected Products

Messageformat

References · 9

• https://osv.dev/vulnerability/CVE-2025-57349 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xfqm-j7pc-xrfc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57349 · Security Note
• https://github.com/messageformat/messageformat/issues/452 · Note
• https://github.com/messageformat/messageformat · Note
• https://twitter.com/VulmonFeeds/status/1971056453520617731 · Twitter Post
• https://t.me/cveNotify/139154 · Telegram Post
• https://twitter.com/CVEnew/status/1970996103471562918 · Twitter Post
• https://t.me/CVEtracker/33287 · Telegram Post