Prototype Pollution in min-document

[me0wxy]

Summary

A prototype pollution vulnerability in the min-document package allows attackers to manipulate JavaScript object prototypes via improper handling of namespace operations in the removeAttributeNS method. This can lead to denial of service or arbitrary code execution in applications using affected versions.

Details

The vulnerability arises from insufficient validation of attribute namespace removal operations in the removeAttributeNS method. When processing input containing the __proto__ property, the method incorrectly modifies the prototype chain of critical JavaScript objects. This behavior stems from mishandling of namespace operations in the DOM implementation logic, as described in CWE-1321.

The issue affects versions prior to 2.19.0 of the package. While version 2.19.0 is marked as the latest available version, the vulnerability remains unaddressed in this release according to the package maintainer's analysis.

Impact

This is a prototype pollution vulnerability (CWE-1321) that affects any application using min-document versions <2.19.0. Attackers can exploit this to:

• Delete or overwrite critical object properties (e.g., toString)
• Trigger denial of service conditions
• Potentially execute arbitrary code in the context of the application

Users are advised to audit their dependencies and avoid untrusted input processing with this package until a fix becomes available.#

[Raynos]

This library is unmaintained / deprecated .

[jameswassink]

I've proposed a pull request to fix this: #55

[abhijeetJaisw]

I've proposed a pull request to fix this: #55

i've approved this

[jfrej]

As per my comment on the PR, I don't think this is a reasonable fix.

Moreover, I'm not sure this vulnerability is valid. I'd like to see an example of how removeAttributeNS could be abused to pollute the prototype.

[arbezerra]

They included an example¹, but it’s not clear to me how this could lead to any practical or security-relevant impact.

[1] - https://github.com/OrangeShieldInfos/PoCs/blob/main/JavaScript/prototype-pollution/CVE-2025-57352/index.js

[andrewbrennanfr]

So what's the next step here? Regardless of whether it's unclear or not if this has a real practical impact - it's still being flagged as a vulnerability for lots of projects. Is the intention to fix this?

[Raynos]

if it's important ill release a patch version.

[Raynos]

2.19.1 published.

[andrewbrennanfr]

Thank you very much 👍 it solves the issue for me