CVE-2025-13158: apidoc-core Prototype Pollution Vulnerability
Summary
CVE-2025-13158: apidoc-core has a prototype pollution vulnerability. Affects apidoc-core versions >= 0.2.0, <= 0.15.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
apidoc-core is a widely used npm package that facilitates the generation of API documentation from annotated source code. It allows developers to create and maintain documentation easily, ensuring that APIs are well-documented and accessible. However, certain versions of apidoc-core are susceptible to a prototype pollution vulnerability that can compromise the integrity of JavaScript object prototypes.
Vulnerability Detail
The prototype pollution vulnerability in apidoc-core versions 0.2.0 and later enables remote attackers to manipulate JavaScript object prototypes through malformed data structures. This issue arises from the improper handling of the 'define' property in the preProcess() function across several worker modules, including api_group.js, api_param_title.js, api_use.js, and api_permission.js. The consequences of this vulnerability can lead to denial of service or unpredictable behavior in applications that depend on the integrity of prototype chains, making it critical to address.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to sanitize any data structures processed by the application, ensuring that they do not contain malicious payloads that could exploit the prototype pollution vulnerability.
Conclusion
The prototype pollution vulnerability in apidoc-core poses significant risks to applications using this package. It is crucial for developers to update to the latest patched version to mitigate these risks and ensure the integrity of their applications. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for apidoc-core →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify the prototype of a base object in JavaScript, potentially leading to unexpected behavior in applications.
The vulnerability affects apidoc-core versions 0.2.0 and all subsequent versions up to the latest release.
Exploiting this vulnerability can lead to denial of service or unintended behavior in applications that rely on JavaScript object prototypes, which can compromise application security and functionality.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. By analyzing your package-lock.json file, it can identify if your application is affected by this vulnerability. You can also check the Vulert playground at Vulert Scanner without any signup.
The CVSS score for this vulnerability is 9.3, indicating a critical level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for apidoc-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
