CVE-2025-48054: Radashi Radashi Allows Improperly Controlled Modification Vulnerability

MODERATE
Advisory Identifier: GHSA-2xv9-ghh9-xc69
Share
CWE-1321
Published
Advisory Summary

CVE-2025-48054 is a MODERATE radashi allows improperly controlled modification vulnerability (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')) affecting Radashi libraries in the npm ecosystem. The issue involves radashi allows improperly controlled modification of object prototype attributes ('prototype pollution'). Remediation is available by upgrading affected packages to version 12.5.1.

CVE-2025-48054 at a Glance

CVE Identifier CVE-2025-48054
GHSA Identifier GHSA-2xv9-ghh9-xc69
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Affected Product Radashi
Package Ecosystem npm
Published Date
Last Updated

How to Fix CVE-2025-48054

To remediate this vulnerability, upgrade all affected Radashi dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

radashi fixed: 12.5.1 
npm install radashi@12.5.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls radashi

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2025-48054, inspect your project dependencies using npm:

npm ls radashi

Analyze the terminal output to locate any version of Radashi in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 12.5.1), your application is affected.

Note: The npm ls radashi command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), where the product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. In Radashi, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact This is a prototype pollution vulnerability. It impacts users of the `set` function within the Radashi library. If an attacker can control parts of the `path` argument to the `set` function, they could potentially modify the prototype of all objects in the JavaScript runtime, leading to unexpected behavior, denial of service, or even remote code execution in some specific scenarios. ### Patches The vulnerability has been patched in commit [`8147abc8cfc3cfe9b9a17cd389076a5d97235a66`](https://github.com/radashi-org/radashi/commit/8147abc8cfc3cfe9b9a17cd389076a5d97235a66). Users should upgrade to a version of Radashi that includes this commit. The fix utilizes a new helper function, `isDangerousKey`, to prevent the use of `__proto__`, `prototype`, or `constructor` as keys in the path, throwing an error if any are encountered. This check is bypassed for objects with a `null` prototype. ### Workarounds Users on older versions can mitigate this vulnerability by sanitizing the `path` argument provided to the `set` function to ensure that no part of the path string is `__proto__`, `prototype`, or `constructor`. For example, by checking each segment of the path before passing it to the `set` function. ### References - Git commit: [`8147abc8cfc3cfe9b9a17cd389076a5d97235a66`](https://github.com/radashi-org/radashi/commit/8147abc8cfc3cfe9b9a17cd389076a5d97235a66) - CWE-1321: Improperly Controlled Modification of Dynamically-Determined Object Attributes ('Prototype Pollution'): https://cwe.mitre.org/data/definitions/1321.html

CVE-2025-48054 Affected Radashi Versions

1 component(s)
Fixed Versions:
12.5.1
Product / Package Ecosystem Affected Versions Fixed Version
radashi
npm/radashi
npm
< 12.5.1
12.5.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/radashi-org/radashi/security/advisories/GHSA-2xv9-ghh9-xc69
NVD — CVE-2025-48054 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-48054
Security Fix Commit FIX COMMIT
https://github.com/radashi-org/radashi/commit/8147abc8cfc3cfe9b9a17cd389076a5d97235a66
Radashi Source Repository REPOSITORY
https://github.com/radashi-org/radashi

Frequently Asked Questions

What is CVE-2025-48054?
CVE-2025-48054 is a security vulnerability in Radashi involving radashi Allows Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
Which Radashi versions are affected?
Affected versions include releases prior to 12.5.1 across affected packages: radashi.
What version fixes CVE-2025-48054?
Upgrading to 12.5.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is radashi affected?
Yes, radashi is affected in releases prior to 12.5.1. Upgrade your dependency to 12.5.1 or later.
What CWE is associated with CVE-2025-48054?
CVE-2025-48054 is classified under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.).
How can I check npm dependencies for CVE-2025-48054?
Run the dependency tree command: 'npm ls radashi'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2xv9-ghh9-xc69",
  "modified" : "2025-05-27T15:03:05Z",
  "published" : "2025-05-27T15:03:05Z",
  "aliases" : [ "CVE-2025-48054" ],
  "summary" : "radashi Allows Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')",
  "details" : "### Impact\n\nThis is a prototype pollution vulnerability. It impacts users of the `set` function within the Radashi library. If an attacker can control parts of the `path` argument to the `set` function, they could potentially modify the prototype of all objects in the JavaScript runtime, leading to unexpected behavior, denial of service, or even remote code execution in some specific scenarios.\n\n### Patches\n\nThe vulnerability has been patched in commit [`8147abc8cfc3cfe9b9a17cd389076a5d97235a66`](https://github.com/radashi-org/radashi/commit/8147abc8cfc3cfe9b9a17cd389076a5d97235a66). Users should upgrade to a version of Radashi that includes this commit. The fix utilizes a new helper function, `isDangerousKey`, to prevent the use of `__proto__`, `prototype`, or `constructor` as keys in the path, throwing an error if any are encountered. This check is bypassed for objects with a `null` prototype.\n\n### Workarounds\n\nUsers on older versions can mitigate this vulnerability by sanitizing the `path` argument provided to the `set` function to ensure that no part of the path string is `__proto__`, `prototype`, or `constructor`. For example, by checking each segment of the path before passing it to the `set` function.\n\n### References\n\n- Git commit: [`8147abc8cfc3cfe9b9a17cd389076a5d97235a66`](https://github.com/radashi-org/radashi/commit/8147abc8cfc3cfe9b9a17cd389076a5d97235a66)\n- CWE-1321: Improperly Controlled Modification of Dynamically-Determined Object Attributes ('Prototype Pollution'): https://cwe.mitre.org/data/definitions/1321.html",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "radashi"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "12.5.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/radashi-org/radashi/security/advisories/GHSA-2xv9-ghh9-xc69"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-48054"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/radashi-org/radashi/commit/8147abc8cfc3cfe9b9a17cd389076a5d97235a66"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/radashi-org/radashi"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1321" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-05-27T15:03:05Z",
    "nvd_published_at" : "2025-05-27T05:15:23Z"
  }
}