CVE-2025-57326

Vulnerability

Overview A prototype pollution vulnerability exists in the byGroupAndType function of the sassdoc-extras package, versions 2.5.1 and earlier [1]. The function fails to properly sanitize user-supplied input, allowing an attacker to inject properties into Object.prototype [1][3]. This type of vulnerability is classified under CWE-1321 [3].

Exploitation

An attacker can exploit this by providing a crafted payload to the byGroupAndType function, which is used by SassDoc theme builders [2][3]. No authentication is required if the function is exposed to untrusted input. The attack surface depends on how the package is integrated into applications [2].

Impact

The minimum consequence is denial of service (DoS) [1]. However, prototype pollution can potentially lead to more severe impacts such as data integrity compromise or arbitrary code execution, depending on the application's use of the polluted prototype [3]. The official description notes DoS as the minimum, but other sources mention additional risks [1][3].

Mitigation

As of the publication date, no patch is available [3]. Users should avoid passing untrusted data to the byGroupAndType function or consider using alternative packages until a fix is released [2][3].