AIKIDO-2025-10109
xregexp is vulnerable to Prototype Pollution
70
High Risk
This Affects:
xregexpTL;DR
The latest version of xregexp (5.1.1) is vulnerable to prototype pollution through the XRegExp.cache function. An attacker can supply a crafted payload with a pattern and flag to manipulate properties within the global prototype chain. This vulnerability can lead to more severe injection-based attacks, depending on how the library is used. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., exec, eval), an attacker could execute arbitrary commands within the application's context.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
xregexp is vulnerable to Prototype Pollution in versions 5.0.0 - 5.1.1.
How to fix this
Upgrade the xregexp library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant