CVE-2025-57348

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-57348
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57348.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-57348
Aliases
Published
2025-09-24T00:00:00Z
Modified
2026-10-21T02:54:07Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVSS Calculator
Summary
[none]
Details

The node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype chain initialization, which could allow an attacker to inject properties into the prototype of built-in objects. This issue, categorized under CWE-1321, arises from improper validation of user-supplied input in the package's resource initialization process. Successful exploitation may lead to denial of service or arbitrary code execution in affected environments. The vulnerability affects versions up to and including 5.0.0-beta.19, and no official fix has been released to date.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57348.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "5.0.0"
                        }
                    ],
                    "source":  "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/node-cube/cube

Affected ranges

Type
GIT
Repo
https://github.com/node-cube/cube
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
ef96598b8e8e73a643c4b18b0179fe444d082eda
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "5.0.0-beta.19"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

v0.*
v0.0.10
v0.0.15
v0.0.16
v0.0.17
v0.0.18
v0.0.2
v0.0.5
v0.0.6
v0.0.7
v0.0.9
v0.1.0
v0.1.1
v0.1.3
v0.1.4
v0.2.7
v1.*
v1.0.0
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v2.*
v2.0.0
v2.0.1
v3.*
v3.0.0-beta.10
v3.0.0-beta.14
v3.0.0-beta.2
v3.0.0-beta.4
v3.0.0-beta.6
v3.0.0-beta.7
v3.0.0-beta.8
v3.0.0-beta.9
v3.1.21
v3.1.23
v3.1.24
v3.1.25
v3.1.27
v5.*
v5.0.0-beta.17
v5.0.0-beta.19

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57348.json"