CVE-2025-13158: 
JavaScript vulnerability analysis and mitigation

CVE-2025-13158 is a prototype pollution vulnerability in the apidoc-core npm package that allows remote attackers to modify JavaScript object prototypes via malformed data structures. It affects versions 0.2.0 through 0.15.0 (all subsequent versions from 0.2.0), with no patched version listed as of the advisory date. The vulnerability was discovered by James Montaño of the Sonatype Security Research Team and publicly disclosed on December 26, 2025. It carries a CVSS v4.0 base score of 9.3 (Critical) (Sonatype Advisory, GitHub Advisory).

The vulnerability is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — 'Prototype Pollution'). The root cause lies in insufficient validation of input data structures within the preProcess() function across four worker modules: api_group.js, api_param_title.js, api_use.js, and api_permission.js. An attacker can supply malformed data containing specially crafted properties (such as __proto__, constructor, or the "define" property processed by the application) that propagate up the prototype chain, affecting all objects in the JavaScript runtime. No authentication or user interaction is required, and the attack is executable remotely over the network with low complexity (Sonatype Advisory, GitHub Advisory).

Successful exploitation can lead to denial of service, compromise of application integrity, and unintended application behavior by corrupting shared JavaScript object prototypes. Because prototype pollution affects the global object prototype, all objects in the affected Node.js process may inherit attacker-controlled properties, potentially enabling logic bypasses, privilege escalation within the application, or crashes. The CVSS v4.0 scoring reflects high impacts on confidentiality, integrity, and availability of the vulnerable system (Sonatype Advisory, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Sonatype Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.126% (31st percentile), indicating a low near-term exploitation probability (GitHub Advisory). No threat actor attribution has been reported.

1. Identify target: Locate applications that use apidoc-core versions 0.2.0–0.15.0 as a dependency, particularly those that process user-supplied API documentation data or accept external input passed to the preProcess() function.
2. Craft malicious payload: Construct a malformed data structure containing a prototype-polluting property, such as {"__proto__": {"polluted": true}} or leveraging the "define" property specifically processed by the affected modules (e.g., api_group.js, api_param_title.js, api_use.js, api_permission.js).
3. Submit payload: Deliver the malformed data structure to the application through any input channel that feeds into the preProcess() function — for example, via API documentation source files or network-accessible endpoints that trigger apidoc-core processing.
4. Trigger prototype pollution: The preProcess() function processes the malformed input without sanitization, causing the attacker-controlled properties to be merged into Object.prototype, affecting all subsequently created objects in the runtime.
5. Achieve objective: Depending on application logic, the polluted prototype may cause denial of service (crashes, infinite loops), bypass security checks that rely on property existence, or trigger unintended code paths (Sonatype Advisory, GitHub Advisory).

• Logs: Unexpected application errors or crashes in Node.js processes using apidoc-core; stack traces referencing preProcess() in api_group.js, api_param_title.js, api_use.js, or api_permission.js.
• File System: Presence of apidoc-core versions 0.2.0–0.15.0 in node_modules/apidoc-core/package.json.
• Process Behavior: Unusual or unexpected property values appearing on base JavaScript objects (Object.prototype) at runtime; application logic behaving inconsistently due to inherited prototype properties.
• Network: Unexpected or malformed input data structures submitted to endpoints that invoke apidoc-core processing, particularly payloads containing __proto__, constructor, or define keys at unexpected nesting levels.

The GitHub Advisory lists affected versions as >= 0.2.0, <= 0.15.0 with no patched version currently available (GitHub Advisory). Organizations should monitor the apidoc/apidoc-core repository for a patched release and upgrade immediately when available. In the interim, validate and sanitize all input data structures before they are processed by preProcess(), implement strict input validation to reject keys such as __proto__, constructor, and prototype, and consider temporarily disabling or restricting use of the affected modules. Using Object.freeze(Object.prototype) in the application startup can also help prevent prototype pollution as a defense-in-depth measure (Sonatype Advisory).

The vulnerability was discovered and reported by James Montaño of the Sonatype Security Research Team, who published the initial advisory (Sonatype Advisory). Community discussion was noted on Mastodon/infosec.exchange and social.circl.lu shortly after disclosure. Red Hat also tracked the CVE, indicating broader ecosystem awareness (Red Hat CVE). Overall community reaction has been moderate, consistent with a supply-chain library vulnerability lacking an immediate patch.