Skip to content
OpenAdvisories
High · 7.5 CVE-2025-57327 EUVD-2025-31058GHSA-r2rv-8pp3-65xw

spmrc vulnerable to prototype pollution

Published Sep 24, 2025 · Updated Sep 26, 2025 · Assigned by mitre

Description

spmrc is a package that provides the rc manager for spm. A Prototype Pollution vulnerability in the set and config function of spmrc version 1.2.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.

Affected packages

EcosystemPackageAffectedFixedRecord
npm spmrc <= 1.2.0 — GHSA-r2rv-8pp3-65xw

References