CVE-2025-55164

content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called __proto__, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves disabling prototype method in NodeJS, neutralizing all possible prototype pollution attacks. Provide either --disable-proto=delete (recommended) or --disable-proto=throw as an argument to node to enable this feature.

CVSS

No CVSS.

References

Link	Resource
https://github.com/helmetjs/content-security-policy-parser/commit/b13a52554f0168af393e3e38ed4a94e9e6aea9dc
https://github.com/helmetjs/content-security-policy-parser/issues/11
https://github.com/helmetjs/content-security-policy-parser/security/advisories/GHSA-w2cq-g8g3-gm83

Configurations

No configuration.

History

13 Aug 2025, 17:34

Type	Values Removed	Values Added
Summary		(es) content-security-policy-parser analiza las directivas de políticas de seguridad de contenido. Existe una vulnerabilidad de contaminación de prototipos en las versiones 0.5.0 y anteriores, donde si el nombre de una política se llama __proto__, se puede anular el prototipo del objeto. Este problema se ha corregido en la versión 0.6.0. Una solución alternativa consiste en deshabilitar el método de prototipo en NodeJS, neutralizando así todos los posibles ataques de contaminación de prototipos. Proporcione --disable-proto=delete (recomendado) o --disable-proto=throw como argumento a node para habilitar esta función.

12 Aug 2025, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-12 16:15

Updated : 2025-08-13 17:34

NVD link : CVE-2025-55164

Mitre link : CVE-2025-55164

CVE.ORG link : CVE-2025-55164

JSON object : View

Products Affected

No product.

CWE

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2025-55164", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-12T16:15:29.253", "references": [{"url": "https://github.com/helmetjs/content-security-policy-parser/commit/b13a52554f0168af393e3e38ed4a94e9e6aea9dc", "source": "security-advisories@github.com"}, {"url": "https://github.com/helmetjs/content-security-policy-parser/issues/11", "source": "security-advisories@github.com"}, {"url": "https://github.com/helmetjs/content-security-policy-parser/security/advisories/GHSA-w2cq-g8g3-gm83", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called __proto__, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves disabling prototype method in NodeJS, neutralizing all possible prototype pollution attacks. Provide either --disable-proto=delete (recommended) or --disable-proto=throw as an argument to node to enable this feature."}, {"lang": "es", "value": "content-security-policy-parser analiza las directivas de pol\u00edticas de seguridad de contenido. Existe una vulnerabilidad de contaminaci\u00f3n de prototipos en las versiones 0.5.0 y anteriores, donde si el nombre de una pol\u00edtica se llama __proto__, se puede anular el prototipo del objeto. Este problema se ha corregido en la versi\u00f3n 0.6.0. Una soluci\u00f3n alternativa consiste en deshabilitar el m\u00e9todo de prototipo en NodeJS, neutralizando as\u00ed todos los posibles ataques de contaminaci\u00f3n de prototipos. Proporcione --disable-proto=delete (recomendado) o --disable-proto=throw como argumento a node para habilitar esta funci\u00f3n."}], "lastModified": "2025-08-13T17:34:12.350", "sourceIdentifier": "security-advisories@github.com"}