CVE-2025-48054: Radashi Prototype Pollution Vulnerability

CVE-2025-48054 Overview

CVE-2025-48054 is a prototype pollution vulnerability in Radashi, a TypeScript utility toolkit. The flaw resides in the set function and affects all versions prior to 12.5.1. When an attacker controls parts of the path argument passed to set, they can modify the prototype of all objects in the JavaScript runtime. This can trigger unexpected application behavior, denial of service, or remote code execution in specific downstream scenarios. The issue is tracked under [CWE-1321] and was patched in Radashi 12.5.1.

Critical Impact
Attacker-controlled path segments equal to __proto__, prototype, or constructor can pollute the global Object prototype, altering runtime behavior across the entire Node.js process.

Affected Products

Radashi versions prior to 12.5.1
Applications that pass untrusted input to the Radashi set function
Downstream Node.js and TypeScript projects depending on vulnerable Radashi releases

Discovery Timeline

2025-05-27 - CVE-2025-48054 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48054

Vulnerability Analysis

Radashi provides a set utility that writes a value into a nested object using a string or array path. Prior to 12.5.1, the function did not validate individual path segments before traversing and assigning properties. When any segment resolved to __proto__, prototype, or constructor, the write reached the target object's prototype chain instead of an own property.

Because JavaScript objects share Object.prototype, a single successful pollution mutates every subsequent object literal in the runtime. Attackers can inject unexpected properties consumed by security-sensitive logic, such as authorization checks, template rendering, or option-merging routines. In applications that later invoke functions or evaluate strings derived from those polluted properties, this can escalate to remote code execution.

Root Cause

The root cause is missing sanitization of dangerous property keys during recursive assignment inside the set implementation. Radashi treated the path purely as data and delegated property lookup to native bracket-notation semantics, which walk the prototype chain for special keys.

Attack Vector

Exploitation requires that user-controlled data flow into the path argument of set. Common sinks include HTTP request bodies parsed as JSON, query strings mapped to configuration objects, and dynamic form builders. No authentication or user interaction is required when the vulnerable code path is reachable over the network.

typescript

// Security patch in src/mod.ts - exports the new guard helper
 export * from './object/filterKey.ts'
 export * from './object/get.ts'
 export * from './object/invert.ts'
+export * from './object/isDangerousKey.ts'
 export * from './object/keys.ts'
 export * from './object/listify.ts'
 export * from './object/lowerize.ts'

Source: Radashi commit 8147abc

typescript

// New helper introduced in src/object/isDangerousKey.ts
+/**
+ * Check if a property key is "dangerous" in the sense that it could
+ * be used to modify built-in objects, possibly leading to prototype
+ * pollution or other unintended side effects.
+ *
+ * If you pass an object, it will be checked for a `null` prototype,
+ * in which case, the key will be considered safe.
+ *
+ * @see https://radashi.js.org/reference/object/isDangerousKey
+ * @version 12.5.1
+ */
+export function isDangerousKey(key: PropertyKey, object?: object): boolean {
+  return (
+    !(object && !Object.getPrototypeOf(object)) &&
+    (key === '__proto__' || key === 'prototype' || key === 'constructor')
+  )
+}

Source: Radashi commit 8147abc

Detection Methods for CVE-2025-48054

Indicators of Compromise

Presence of __proto__, prototype, or constructor tokens inside JSON request bodies, query strings, or form fields sent to Node.js services
Unexpected properties appearing on freshly created object literals during runtime debugging
Node.js processes exhibiting altered control flow after handling attacker-supplied nested paths

Detection Strategies

Perform Software Composition Analysis (SCA) to identify projects with Radashi versions earlier than 12.5.1 in package.json and package-lock.json
Add runtime assertions or use Object.create(null) for objects used as maps to detect prototype writes
Inspect application logs for anomalies following requests containing prototype-related keywords

Monitoring Recommendations

Enable HTTP body inspection at the web application firewall to flag payloads containing __proto__ or constructor.prototype
Monitor Node.js processes for crashes or logic anomalies correlated with recent user input events
Track dependency drift with continuous SBOM generation to catch reintroduction of vulnerable Radashi versions

How to Mitigate CVE-2025-48054

Immediate Actions Required

Upgrade Radashi to version 12.5.1 or later in every project and lockfile
Audit application code for calls to set that accept externally influenced path arguments
Rebuild and redeploy container images and serverless bundles to ensure the patched dependency is loaded

Patch Information

The fix landed in Radashi 12.5.1 via commit 8147abc. It introduces an isDangerousKey helper that rejects __proto__, prototype, and constructor unless the target object has a null prototype. Full details are in the GitHub Security Advisory GHSA-2xv9-ghh9-xc69.

Workarounds

Sanitize user-supplied path strings and reject any segment equal to __proto__, prototype, or constructor before invoking set
Use Object.create(null) for target objects passed to set so the prototype chain is empty and cannot be polluted
Validate incoming JSON payloads with a schema library that rejects reserved property names

bash

# Upgrade Radashi to the patched version
npm install radashi@^12.5.1

# Verify the installed version
npm ls radashi

# Optional: audit the project for remaining advisories
npm audit --production