CVE-2025-57353
1 advisory.
npm/@messageformat/runtime CVE-2025-57353: medium 5.3, EPSS 0.35%
messageformat prototype pollution vulnerability
Action: Upgrade @messageformat/runtime to 3.0.2 or later.
npm i @messageformat/runtime@3.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.1 | 3.0.2 | - |
Fixed versions
| 3.0.2 |
Sources
- osv: GHSA-6xv4-9cqp-92rh
- https://nvd.nist.gov/vuln/detail/CVE-2025-57353
- https://github.com/messageformat/messageformat/issues/453
- https://github.com/messageformat/messageformat/issues/453#issuecomment-3466959449
- https://github.com/messageformat/messageformat/pull/464
- https://github.com/messageformat/messageformat/commit/82cd10b40e3f922f990bbcf88a6d14b70c0a3ce0
- https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57353
- https://github.com/messageformat/messageformat
CVE-2025-57353 · published · modified · JSON