@0xbigboss/vite-plugin-web-extension (>=5.2.0, <=5.4.0), @58860ed6ffd9e897/gold-finger-extension (1.0.2) +55 more potentially affected by CVE-2025-55164 via content-security-policy-parser (>=0.1.1, <=0.4.1)

content-security-policy-parser NPM version =0.1.1, =5.2.0, =2.13.1-next.0, =2.12.1-canary.3354, =2.12.1-canary.3354, =2.12.5-beta.0, =0.84.3, =0.0.0-experimental-15dcc54, =0.0.0-experimental-4515339, =0.0.0-experimental-2cd2b9e, =0.0.0-experimental-15dcc54, =0.0.0-experimental-15dcc54,...

@0xbigboss/vite-plugin-web-extension (>=5.2.0, <=5.4.0), @58860ed6ffd9e897/gold-finger-extension (1.0.2) +55 more potentially affected by CVE-2025-55164 via content-security-policy-parser (>=0.1.1, <=0.5.0)

content-security-policy-parser NPM version =0.1.1, =5.2.0, =2.13.1-next.0, =2.12.1-canary.3354, =2.12.1-canary.3354, =2.12.5-beta.0, =0.84.3, =0.0.0-experimental-15dcc54, =0.0.0-experimental-4515339, =0.0.0-experimental-2cd2b9e, =0.0.0-experimental-15dcc54, =0.0.0-experimental-15dcc54,...

Prototype Pollution

Overview content-security-policy-parser is a Parse Content Security Policy directives. Affected versions of this package are vulnerable to Prototype Pollution via the parse function. An attacker can manipulate the Object prototype by supplying a crafted policy name in HTTP queries, potentially...

CVE-2025-55164 content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE

content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called proto, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves...

CVE-2025-55164: Improperly Controlled Modification of Object Prototype Attributes

content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called proto, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves...