Description
Prototype pollution vulnerability via .parse() in Plist allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.
Recommendation
Update the plist package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.0.5
- Patched version(s): 3.0.5
References
Related Issues
- Strapi Password Hashing is Missing Maximum Password Length Validation - CVE-2025-25298
- DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware - CVE-2025-59037
- Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) 2 - CVE-2025-4643
- The AuthKit React Router Library rendered sensitive auth data in HTML - CVE-2025-55008
- Tags:
- npm
- plist
Anything's wrong? Let us know Last updated on November 29, 2023