Executive brief
content-security-policy-parser is a Node.js library that parses HTTP Content-Security-Policy headers. A prototype pollution flaw allows attackers to poison the JavaScript Object prototype via a specially crafted policy string, enabling denial of service and potentially remote code execution when chained with other vulnerable libraries. The library is widely used in web applications, and the vulnerability can be exploited remotely without authentication.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in versions 0.5.0 and earlier. An attacker can inject a policy directive named __proto__ containing arbitrary values to override the Object prototype at parse time. For example, parse("default-src 'self'; __proto__ foobar") modifies Object.prototype, affecting all objects in the application. The attack vector is network-accessible (CSP policies are provided in HTTP headers) with no authentication or user interaction required. While the parser itself contains no RCE gadget chain, the prototype pollution can be chained with other vulnerable libraries to achieve code execution, and is guaranteed to cause denial of service. A patch (version 0.6.0) was released on 11 February 2024, but adoption remains low (only 17% of weekly downloads as of the advisory date).
Affected products
- helmetjs content-security-policy-parser 0.5.0 and earlier
Timeline
- 2025-08-12: disclosed
- 2024-02-11: patched: Patch released as version 0.6.0