Vulnerability · Published Dec 26, 2025 · Assigned by Sonatype

CVE-2025-13158apidoc-core - prototype pollution in api_group.js, api_param_title.js, api_use.js, and api_permission.js worker

Critical 9.3

In plain English

A critical-severity prototype pollution in apidoc-core from apiDoc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.5%top 56.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via malformed data structures, including the “define” property processed by the application, potentially leading to denial of service or unintended behavior in applications relying on the integrity of prototype chains. This affects the preProcess() function in api_group.js, api_param_title.js, api_use.js, and api_permission.js worker modules.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	apidoc-core	no fix listed	GHSA-6vj3-p34w-xxjp

Affected products (as reported)

Vendor	Product	Versions
apiDoc	apidoc-core	0.2.0 – before *

Weakness: CWE-1321 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.sonatype.com/security-advisories/cve-2025-13158 third-party-advisory