Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-48054
CVE-2025-48054:
JavaScript vulnerability analysis and mitigation
Overview
CVE-2025-48054 affects Radashi, a TypeScript utility toolkit. The vulnerability was discovered in the set function of versions prior to 12.5.1, where improper input validation could lead to prototype pollution. The issue was disclosed and patched on May 23, 2025 (GitHub Advisory).
Technical details
The vulnerability stems from insufficient validation in the set function, which could allow modification of object prototypes through specially crafted path arguments. The issue is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). The vulnerability has been assigned a CVSS v4.0 score of 6.8 MEDIUM with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U (NVD).
Impact
If exploited, this vulnerability could allow attackers to modify the prototype of all objects in the JavaScript runtime. This can lead to unexpected behavior, denial of service, or potentially remote code execution in specific scenarios (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been patched in version 12.5.1 with the implementation of a new isDangerousKey helper function that prevents the use of proto, prototype, or constructor as keys in the path. For users unable to upgrade, a workaround involves sanitizing the path argument to ensure no part of the path string contains these dangerous keys (GitHub Advisory, GitHub Commit).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management