CVE-2025-57352 Details

A prototype pollution vulnerability has been identified in the 'min-document' package, affecting versions prior to 2.19.0. The issue arises from improper handling of namespace operations in the 'removeAttributeNS' method, which allows attackers to manipulate the prototype chain of JavaScript objects by processing malicious input that includes the '__proto__' property. This manipulation can lead to denial-of-service conditions or arbitrary code execution within applications using the affected package. The vulnerability is rooted in insufficient validation of attribute namespace removal operations, enabling unintended modifications of critical object prototypes. Notably, while version 2.19.0 is the latest available release, the vulnerability remains unaddressed in this version.