Detections
Analytics

SCA: security update for @messageformat/runtime (GHSA-6xv4-9cqp-92rh)

medium Tenable Self-Hosted Container Security Plugin ID 435421

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution
 vulnerability. Due to insufficient validation of nested message keys during the processing of message
 data, an attacker can manipulate the prototype chain of JavaScript objects by providing specially crafted
 input. This can result in the injection of arbitrary properties into the Object.prototype, potentially
 leading to denial of service conditions or unexpected application behavior. The vulnerability allows
 attackers to alter the prototype of base objects, impacting all subsequent object instances throughout the
 application's lifecycle. (CVE-2025-57353)

See Also

https://github.com/advisories/GHSA-6xv4-9cqp-92rh

Plugin Details

Severity: Medium

ID: 435421

Version: Revision 1.12

Type: Local

Family: SCA Checks

Published: 9/25/2025

Updated: 6/1/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.2

Percentile: 50.9

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2025-57353

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/24/2025

Vulnerability Publication Date: 9/24/2025

Reference Information

CVE: CVE-2025-57353