CVE-2025-48054 in radashi
Summary
by MITRE • 05/27/2025
Radashi is a TypeScript utility toolkit. Prior to version 12.5.1, the set function within the Radashi library is vulnerable to prototype pollution. If an attacker can control parts of the path argument to the set function, they could potentially modify the prototype of all objects in the JavaScript runtime, leading to unexpected behavior, denial of service, or even remote code execution in some specific scenarios. This issue has been patched in version 12.5.1. A workaround for this issue involves sanitizing the path argument provided to the set function to ensure that no part of the path string is __proto__, prototype, or constructor.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/27/2025
The vulnerability identified as CVE-2025-48054 affects the Radashi TypeScript utility toolkit, specifically targeting the set function within versions prior to 12.5.1. This prototype pollution vulnerability arises from insufficient input validation when processing path arguments, creating a critical security risk that can be exploited by malicious actors. The issue stems from the library's failure to properly sanitize user-controllable input, allowing attackers to manipulate object prototypes in ways that can compromise application integrity and stability. The vulnerability is particularly concerning because prototype pollution can lead to cascading security issues throughout JavaScript runtime environments where the affected library is utilized.
The technical flaw manifests when the set function processes path arguments that contain maliciously crafted strings, particularly those referencing prototype-related properties. Attackers can exploit this by providing path strings that include _proto_, prototype, or constructor as components, enabling them to pollute the Object prototype directly. This occurs because the vulnerable implementation does not adequately validate or sanitize the path components before using them to modify object properties. The flaw is classified as a prototype pollution vulnerability under CWE-471, which specifically addresses the modification of prototype properties that can lead to unexpected behavior in JavaScript applications. The vulnerability can be leveraged to manipulate the behavior of all objects inheriting from the polluted prototype, potentially enabling attackers to gain elevated privileges or execute arbitrary code.
The operational impact of this vulnerability extends beyond simple functionality disruption, encompassing potential denial of service conditions and remote code execution scenarios in specific environments. When an attacker successfully pollutes the prototype, they can modify core object behaviors, leading to unpredictable application responses, memory corruption, or complete service unavailability. The vulnerability becomes particularly dangerous in server-side JavaScript environments where the Radashi library might be used to process user input from untrusted sources. In some configurations, this prototype pollution can enable attackers to bypass security controls, manipulate application logic, or even achieve remote code execution through prototype chain manipulation. The risk is amplified when the affected library is used in frameworks or applications that rely heavily on JavaScript's prototype-based inheritance model.
Mitigation strategies for CVE-2025-48054 focus on both immediate patching and temporary workarounds to protect systems until the official update is deployed. The recommended solution involves upgrading to Radashi version 12.5.1 or later, which includes proper input validation and sanitization for the set function. Organizations should also implement input sanitization measures as a defensive approach, specifically ensuring that path arguments provided to the set function are validated to exclude prototype-related keywords such as _proto_, prototype, and constructor. Additional protective measures include implementing proper access controls, monitoring for unusual object property modifications, and conducting thorough code reviews to identify other potential prototype pollution vulnerabilities in the application stack. The ATT&CK framework categorizes this type of vulnerability under T1548.005 for Abuse of Process, as it involves the manipulation of core runtime objects to achieve unauthorized access or execution. Security teams should also consider implementing runtime protection mechanisms that can detect and prevent prototype pollution attempts in real-time, particularly in environments where patching might be delayed due to compatibility concerns or deployment schedules.