N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-57351

CVE-2025-57351: ts-fns has prototype pollution vulnerability

A prototype pollution vulnerability exists in the ts-fns package versions prior to 13.0.7, where insufficient validation of user-provided keys in the assign function allows attackers to manipulate the Object.prototype chain. By leveraging this flaw, adversaries may inject arbitrary properties into the global object's prototype, potentially leading to application crashes, unexpected code execution behaviors, or bypasses of security-critical validation logic dependent on prototype integrity. The vulnerability stems from improper handling of deep property assignment operations within the library's public API functions. This issue remains unaddressed in the latest available version.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-57351

CVE-2025-57351:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ts-fns	npm	<= 13.1.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description explicitly mentions a prototype pollution vulnerability in the assign function of the ts-fns package. While I was unable to locate a function named assign in the provided source code, the description of the vulnerability points to improper handling of deep property assignment operations.

Based on this, I analyzed the es/object.js file, which contains functions responsible for object manipulation. I identified four functions that perform deep property assignments and are vulnerable to prototype pollution: extend, merge, createReactive, and createProxy. All of these functions copy or assign properties from one object to another without proper sanitization of the property keys. This allows an attacker to inject a __proto__ property and pollute the Object.prototype.

It is highly likely that the assign function mentioned in the vulnerability report is an alias for either extend or merge, or that it utilizes one of these vulnerable functions internally. The functions createReactive and createProxy are also vulnerable due to similar unsafe property assignments. Therefore, I have included all four functions in the list of vulnerable functions. The confidence for extend and merge is high due to their direct relation to the vulnerability pattern, while the confidence for createReactive and createProxy is medium as they are more complex and the exploitation path is less direct.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.