AIKIDO-2025-10802

TL;DR

Affected versions of this package are vulnerable to prototype pollution. The charWidthCache object is a plain JavaScript object with keys derived from user-controlled data (such as font family, style, and weight). By setting values like fontFamily to __proto__ or manipulating other font properties, an attacker can modify the global object prototype, potentially leading to unexpected behavior or application instability. Although the injected data is not directly controlled by the attacker, the ability to tamper with Object.prototype poses a significant risk. The issue is resolved by replacing the plain object with a Map, which prevents prototype pollution and provides a safer, more suitable data structure.