Executive brief
apidoc-core is a JavaScript library used to parse API documentation and generate structured output. A prototype pollution vulnerability allows remote attackers to manipulate JavaScript object prototypes through malformed input, potentially causing denial of service or triggering unexpected application behavior in any system that relies on this library for API documentation processing.
Technical details
This prototype pollution vulnerability (CWE-1321) affects the preProcess() function in multiple worker modules (api_group.js, api_param_title.js, api_use.js, and api_permission.js) in apidoc-core versions 0.2.0 through 0.15.0. The vulnerability allows remote attackers to inject malformed data structures containing the "define" property that bypass prototype chain validation, enabling modification of JavaScript object prototypes. The attack is network-accessible with no authentication or user interaction required. Successful exploitation could lead to denial of service or unintended behavior affecting applications that depend on prototype chain integrity. The repository has been archived as of September 2021.
Affected products
- apidoc apidoc-core 0.2.0 through 0.15.0
Timeline
- 2025-12-26: disclosed: GHSA-6vj3-p34w-xxjp and CVE-2025-13158 published