ts-fns up to 13.0.6 assign prototype pollution

Summaryinfo

A vulnerability was found in ts-fns up to 13.0.6. It has been rated as critical. This affects the function assign. Performing a manipulation results in prototype pollution. This vulnerability was named CVE-2025-57351. The attack may be initiated remotely. In addition, an exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in ts-fns up to 13.0.6. This affects the function assign. The manipulation with an unknown input leads to a prototype pollution vulnerability. CWE is classifying the issue as CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A prototype pollution vulnerability exists in the ts-fns package versions prior to 13.0.7, where insufficient validation of user-provided keys in the assign function allows attackers to manipulate the Object.prototype chain. By leveraging this flaw, adversaries may inject arbitrary properties into the global object's prototype, potentially leading to application crashes, unexpected code execution behaviors, or bypasses of security-critical validation logic dependent on prototype integrity. The vulnerability stems from improper handling of deep property assignment operations within the library's public API functions. This issue remains unaddressed in the latest available version.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-57351 since 08/17/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1059 for this issue.

The exploit is shared for download at github.com. It is declared as proof-of-concept.

Upgrading to version 13.0.7 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-31070). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• ts-fns

Version

• 13.0.0
• 13.0.1
• 13.0.2
• 13.0.3
• 13.0.4
• 13.0.5
• 13.0.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion