Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

min-document

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 2.9npmAmendedPublished

    min-document vulnerable to prototype pollution

    CVE-2025-57352 · GHSA-rx8g-88g5-qh64

    Affected
    • npm min-document <= 2.19.0
    Fixed in
    2.19.1· Vendor fix available
    Issue
    A vulnerability exists in the 'min-document' package prior to version 2.19.1, stemming from improper handling of namespace operations in the removeAttributeNS method. By processing malicious input involving the proto property, an attacker can manipulate the prototype chain of JavaScript objects, leading to denial of service or arbitrary code execution. This issue arises from insufficient validation of attribute namespace removal operations, allowing unintended modification of critical object prototypes. The vulnerability is addressed in version 2.19.1.

    Recommended action: Upgrade to 2.19.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →