« Volver al listado

CVE-2025-57353

Estado: AplazadaMedia (5.3)—

The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the processing of message data, an attacker can manipulate the prototype chain of JavaScript objects by providing specially crafted input. This can result in the injection of arbitrary properties into the Object.prototype, potentially leading to denial of service conditions or unexpected application behavior. The vulnerability allows attackers to alter the prototype of base objects, impacting all subsequent object instances throughout the application's lifecycle.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Openjsf — MessageformatAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-57353",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-57353",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-09-25T18:25:47.554162Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-09-24T18:15:41.793",
  "references": [
    {
      "url": "https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57353",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/messageformat/messageformat/commit/82cd10b40e3f922f990bbcf88a6d14b70c0a3ce0",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/messageformat/messageformat/issues/453",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/messageformat/messageformat/issues/453#issuecomment-3466959449",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/messageformat/messageformat/pull/464",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the processing of message data, an attacker can manipulate the prototype chain of JavaScript objects by providing specially crafted input. This can result in the injection of arbitrary properties into the Object.prototype, potentially leading to denial of service conditions or unexpected application behavior. The vulnerability allows attackers to alter the prototype of base objects, impacting all subsequent object instances throughout the application's lifecycle."
    },
    {
      "lang": "es",
      "value": "Los componentes de tiempo de ejecución del paquete messageformat para Node.js anteriores a la versión 3.0.1 contienen una vulnerabilidad de contaminación de prototipos. Debido a la validación insuficiente de claves de mensaje anidadas durante el procesamiento de datos de mensajes, un atacante puede manipular la cadena de prototipos de objetos JavaScript al proporcionar una entrada especialmente diseñada. Esto puede resultar en la inyección de propiedades arbitrarias en el Object.prototype, lo que podría llevar a condiciones de denegación de servicio o un comportamiento inesperado de la aplicación. La vulnerabilidad permite a los atacantes alterar el prototipo de objetos base, impactando todas las instancias de objetos subsiguientes a lo largo del ciclo de vida de la aplicación. Este problema permanece sin abordar en la última versión disponible."
    }
  ],
  "lastModified": "2026-06-17T09:43:03.853",
  "sourceIdentifier": "cve@mitre.org"
}