CVE-2025-57321

Vulnerability

Overview A prototype pollution vulnerability exists in the magix-combine-ex package (versions through 1.2.10) within the util-deps.addFileDepend function. The root cause is insufficient sanitization of the riskyName parameter, allowing an attacker to specify properties like __proto__ to modify the Object prototype. [1][2]

Exploitation

An attacker can supply a crafted payload to the addFileDepend function, injecting arbitrary properties onto Object.prototype. This requires the ability to influence input to this function, typically through a malicious file or request. [2]

Impact

The minimum consequence is denial of service (DoS) due to unexpected behavior across the application. However, as with many prototype pollution flaws, the impact can escalate to arbitrary code execution or data integrity compromise, depending on how the polluted properties are used. [2]

Mitigation

Status No official patch has been released. The latest version (2.2.2) is reportedly also vulnerable. As a workaround, sanitize user inputs to remove keys like __proto__, constructor, and prototype. [2]