CVE-2025-57323

Vulnerability

Overview mpregular, a small program development framework built on RegularJS [2], contains a Prototype Pollution vulnerability in its mp.addEventHandler function. The flaw arises because the function does not sanitize user-controlled event identifier strings before processing, allowing an attacker to inject properties onto Object.prototype via payloads such as "__proto__.pollutedProperty" [1][3].

Exploitation

An attacker can exploit this by supplying a crafted payload as the event identifier to mp.addEventHandler. No authentication or special network position is required if the application passes untrusted input to this function. The lack of input validation enables the attacker to modify the prototype chain of all objects in the runtime [3].

Impact

The minimum consequence is denial of service (DoS) due to unexpected behavior when polluted properties are accessed. However, prototype pollution can also lead to more severe outcomes such as property injection affecting application logic [1][3].

Mitigation

As of the disclosure date, no official fix or mitigation has been published for mpregular versions 0.2.0 and earlier. Users should avoid passing untrusted input to mp.addEventHandler or consider using alternative frameworks until a patch is available [3].