content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE

Description

A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if you provide a policy name called __proto__ you can override the Object prototype.

Recommendation

Update the content-security-policy-parser package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.6.0
• Patched version(s): 0.6.0

References

• GHSA-w2cq-g8g3-gm83
• CVE-2025-55164
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• ts-fns has prototype pollution vulnerability - CVE-2025-57351
• messageformat has a prototype pollution vulnerability - CVE-2025-57349
• Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - CVE-2025-13465
• messageformat prototype pollution vulnerability - CVE-2025-57353

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

3 reasons why any website's security is important

How do hackers hack websites?

Tags:

npm

content-security-policy-parser