Executive brief
Radashi is a TypeScript utility library used by developers to simplify common coding tasks. A vulnerability in its 'set' function allows an attacker to modify the core behavior of the JavaScript environment. This could lead to application crashes, unexpected data changes, or potentially allow an attacker to run unauthorized code on the server.
Technical details
A prototype pollution vulnerability exists in the 'set' function of the Radashi library due to insufficient validation of the 'path' argument. An attacker who can control the path string can inject sensitive keys such as '__proto__', 'constructor', or 'prototype' to modify the base Object prototype. This can result in global state corruption, denial of service, or remote code execution depending on how the application uses the polluted objects. The issue is fixed in version 12.5.1 by implementing a check that rejects dangerous keys.
Affected products
- radashi-org radashi < 12.5.1
Timeline
- 2025-05-23: advisory: Original advisory published by maintainers
- 2025-05-27: disclosed: Public disclosure and CVE assignment
- 2025-05-27: patched: Fix released in version 12.5.1