CVE-2025-57321

A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve@mitre.org

Published

2025-09-24

Last modified

2025-09-26

Weaknesses

CWE-1321

Affected products

• Magix-combine-ex (Magix-combine-ex Project)

References

• https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/magix-combine-ex%401.2.10/index.js
• https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57321