CVE-2025-57352

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-57352
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57352.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-57352
Aliases
Downstream
CGA (74)
DEBIAN (1)
MINI (3)
UBUNTU (1)
Published
2025-09-24T00:00:00Z
Modified
2026-10-21T02:30:28Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

A vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in the removeAttributeNS method. By processing malicious input involving the proto property, an attacker can manipulate the prototype chain of JavaScript objects, leading to denial of service or arbitrary code execution. This issue arises from insufficient validation of attribute namespace removal operations, allowing unintended modification of critical object prototypes. The vulnerability remains unaddressed in the latest available version.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57352.json"
}
References

Affected packages

Git / github.com/raynos/min-document

Affected ranges

Type
GIT
Repo
https://github.com/raynos/min-document
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
97449f71bccf778f351dc4c8d9db0ebf6e8b39cb
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.19.0"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

v0.*
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v0.2.7
v0.2.8
v0.2.9
v0.3.0
v0.3.1
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v2.*
v2.1.0
v2.10.0
v2.11.0
v2.12.0
v2.13.0
v2.14.0
v2.14.1
v2.14.2
v2.15.0
v2.16.0
v2.17.0
v2.17.1
v2.18.0
v2.18.1
v2.2.1
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.6.1
v2.7.0
v2.8.0
v2.8.1
v2.9.0
v2.9.1
v2.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57352.json"