{"action":"Upgrade @messageformat/runtime to 3.0.2 or later.","affected":[{"fixed":"3.0.2","introduced":"3.0.1"}],"component":"@messageformat/runtime","cve_ids":["CVE-2025-57353"],"ecosystem":"npm","epss":0.00346,"exploited":false,"fixed_versions":["3.0.2"],"ghsa_id":"GHSA-6xv4-9cqp-92rh","id":"tcs_01M5KF8B2CBVF48CSWVG6HK0VJ","modified_at":"2025-10-31T15:12:38Z","published_at":"2025-09-24T18:30:31Z","references":["https://osv.dev/vulnerability/GHSA-6xv4-9cqp-92rh","https://nvd.nist.gov/vuln/detail/CVE-2025-57353","https://github.com/messageformat/messageformat/issues/453","https://github.com/messageformat/messageformat/issues/453#issuecomment-3466959449","https://github.com/messageformat/messageformat/pull/464","https://github.com/messageformat/messageformat/commit/82cd10b40e3f922f990bbcf88a6d14b70c0a3ce0","https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57353","https://github.com/messageformat/messageformat"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-6xv4-9cqp-92rh","url":"https://osv.dev/vulnerability/GHSA-6xv4-9cqp-92rh"}],"summary":"messageformat prototype pollution vulnerability"}