min-document vulnerable to prototype pollution

Description

A vulnerability exists in the ‘min-document’ package prior to version 2.19.0, stemming from improper handling of namespace operations in the removeAttributeNS method.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.19.0

References

• GHSA-rx8g-88g5-qh64
• CVE-2025-57352
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Remote code execution via the `pretty` option. - CVE-2021-21353
• GetmeUK ContentTools Cross-Site Scripting (XSS) - CVE-2025-2699
• node-gettext vulnerable to Prototype Pollution - CVE-2024-21528
• Axios Cross-Site Request Forgery Vulnerability - CVE-2023-45857

Tags:

npm

min-document