Loading vulnerability…
Prototype Pollution in apidoc-core preProcess
CVE-2025-13158 is a prototype-pollution vulnerability in apidoc-core 0.2.0 and later. The preProcess() function in the api_group.js, api_param_title.js, api_use.js, and api_permission.js worker modules processes malformed data structures, including the define property, in a manner that permits modification of JavaScript object prototypes.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can corrupt JavaScript prototype chains, causing denial of service or unintended behavior in applications that rely on prototype-chain integrity.
If you can’t patch tonight, do this now.
Do not allow untrusted input to control the define property. Sanitize untrusted data structures to reject prototype-pollution primitives before processing.
Patch, then assume compromise.
Update apidoc-core to a patched version when one is available. Validate and sanitize incoming data structures before they reach affected processing functions.
No public exploits tracked yet. Mallory keeps watching.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.