PT-2025-53598 · Unknown · Apidoc-Core

James Montaño · Published 2025-12-26 · Updated 2025-12-27 · CVE-2025-13158

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions apidoc-core versions 0.2.0 and subsequent versions

Description A prototype pollution issue exists in apidoc-core. This allows remote attackers to modify JavaScript object prototypes through malformed data structures, specifically the “define” property processed by the application. This can lead to denial of service or unexpected application behavior due to compromised prototype chains. The issue affects the preProcess() function within the following worker modules: api group.js, api param title.js, api use.js, and api permission.js.

Recommendations Update apidoc-core to a version later than 0.2.0.

Fix

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-13158

Affected Products

Apidoc-Core

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13158 · Security Note
• https://sonatype.com/security-advisories/cve-2025-13158 · Note
• https://twitter.com/transilienceai/status/2004756836990226767 · Twitter Post
• https://twitter.com/CVEnew/status/2004666596539711726 · Twitter Post
• https://t.me/cveNotify/146898 · Telegram Post
• https://t.me/CVEtracker/40719 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2004604607243153436 · Twitter Post
• https://twitter.com/0dayPublishing/status/2004585661802652157 · Twitter Post