Executive brief
apidoc-core is a widely-used library for parsing API documentation specifications and generating API documentation. A prototype pollution vulnerability allows attackers to supply specially crafted input that corrupts the JavaScript object prototype chain, causing the affected application to malfunction or become unavailable. This could disrupt any build or documentation pipeline that depends on apidoc-core.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the preProcess function of the api_body_title module. It occurs because the software improperly validates and merges user-supplied "define" properties from nested data structures without restricting assignment to prototype attributes. An attacker can craft a malicious API documentation file with specially crafted properties that, when parsed, pollute Object.prototype with arbitrary attributes. This requires network access if the apidoc-core parsing is exposed via an API, or local access if processing user-supplied files. The attack causes denial of service by corrupting object inheritance chains and unintended behavior in dependent code. The repository was archived in September 2021 and is now part of the main apidoc repository; patch status for this specific vulnerability is not clear from available information.
Affected products
- apidoc apidoc-core 0.15.0 and earlier
Timeline
- 2025-09-25: disclosed: Vulnerability published to NVD and GitHub Advisory Database
- 2021-09: other: apidoc-core repository archived; project merged into main apidoc repository