GHSA-6vj3-p34w-xxjp

Source

https://github.com/advisories/GHSA-6vj3-p34w-xxjp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-6vj3-p34w-xxjp/GHSA-6vj3-p34w-xxjp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6vj3-p34w-xxjp

Aliases

CVE-2025-13158

Published

2025-12-26T18:30:26Z

Modified

2025-12-26T20:11:13Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

apidoc-core has a prototype pollution vulnerability

Details

Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via malformed data structures, including the “define” property processed by the application, potentially leading to denial of service or unintended behavior in applications relying on the integrity of prototype chains. This affects the preProcess() function in api_group.js, api_param_title.js, api_use.js, and api_permission.js worker modules.

Database specific

{
    "cwe_ids":  [
        "CWE-1321"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-12-26T19:50:17Z",
    "nvd_published_at":  "2025-12-26T16:15:43Z",
    "severity":  "CRITICAL"
}

References

Affected packages

npm / apidoc-core

Package

Name: apidoc-core; View open source insights on deps.dev
Purl: pkg:npm/apidoc-core

Affected ranges

Type: SEMVER
Events: Introduced

0.2.0

Last Affected

0.15.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-6vj3-p34w-xxjp/GHSA-6vj3-p34w-xxjp.json"