@0xbigboss/vite-plugin-web-extension (>=5.2.0 <=5.4.0), @58860ed6ffd9e897/gold-finger-extension (=1.0.2) +54 more potentially affected by CVE-2025-55164 via content-security-policy-parser (>=0.1.1 <=0.4.1)

content-security-policy-parser NPM version =0.1.1, =5.2.0, =2.13.1, =2.12.1-canary.3354, =2.12.1-canary.3354, =2.12.5, =0.84.3, =0.0.0-experimental-2cc8de3, =0.0.0-experimental-4529dd0, =0.0.0-experimental-2cd2b9e, =0.0.0-experimental-2cc8de3, =0.0.0-experimental-2cc8de3,...

@0xbigboss/vite-plugin-web-extension (>=5.2.0 <=5.4.0), @58860ed6ffd9e897/gold-finger-extension (=1.0.2) +54 more potentially affected by CVE-2025-55164 via content-security-policy-parser (>=0.1.1 <=0.5.0)

content-security-policy-parser NPM version =0.1.1, =5.2.0, =2.13.1, =2.12.1-canary.3354, =2.12.1-canary.3354, =2.12.5, =0.84.3, =0.0.0-experimental-2cc8de3, =0.0.0-experimental-4529dd0, =0.0.0-experimental-2cd2b9e, =0.0.0-experimental-2cc8de3, =0.0.0-experimental-2cc8de3,...

Prototype Pollution

Overview content-security-policy-parser is a Parse Content Security Policy directives. Affected versions of this package are vulnerable to Prototype Pollution via the parse function. An attacker can manipulate the Object prototype by supplying a crafted policy name in HTTP queries, potentially...

CVE-2025-55164 content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE

content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called proto, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves...