spmrc is a package that provides the rc manager for spm. A Prototype Pollution vulnerability in the set and config function of spmrc version 1.2.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.
References
Configurations
History
20 Oct 2025, 16:50
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Spmjs
Spmjs spmrc |
|
| References | () https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/spmrc%401.2.0/index.js - Broken Link | |
| References | () https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57327 - Third Party Advisory | |
| CPE | cpe:2.3:a:spmjs:spmrc:*:*:*:*:*:node.js:*:* |
26 Sep 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-1321 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
24 Sep 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-24 20:15
Updated : 2025-10-20 16:50
NVD link : CVE-2025-57327
Mitre link : CVE-2025-57327
CVE.ORG link : CVE-2025-57327
JSON object : View
Products Affected
spmjs
- spmrc
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')