[GHSA-rx8g-88g5-qh64] min-document vulnerable to prototype pollution

[G-Rath]

Updates

• Affected products
• CVSS v4
• Description
• References
• Severity

Comments
Added patched version

[Copilot]

Pull Request Overview

This PR updates a GitHub Security Advisory (GHSA-rx8g-88g5-qh64) for a prototype pollution vulnerability in the min-document package. The changes reflect that version 2.19.1 fixes the vulnerability, adjusting severity and CVSS scoring accordingly.

• Updated vulnerability status from "last_affected" to "fixed" with version 2.19.1
• Increased severity from LOW to MODERATE and adjusted CVSS score
• Added reference to the pull request that fixed the vulnerability

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The details field states 'The vulnerability remains unaddressed in the latest available version,' but this contradicts the update showing the vulnerability is fixed in version 2.19.1. This sentence should be removed or updated to reflect that the vulnerability has been addressed.

Suggested change

"details": "A vulnerability exists in the 'min-document' package prior to version 2.19.1, stemming from improper handling of namespace operations in the removeAttributeNS method. By processing malicious input involving the __proto__ property, an attacker can manipulate the prototype chain of JavaScript objects, leading to denial of service or arbitrary code execution. This issue arises from insufficient validation of attribute namespace removal operations, allowing unintended modification of critical object prototypes. The vulnerability remains unaddressed in the latest available version.",

"details": "A vulnerability exists in the 'min-document' package prior to version 2.19.1, stemming from improper handling of namespace operations in the removeAttributeNS method. By processing malicious input involving the __proto__ property, an attacker can manipulate the prototype chain of JavaScript objects, leading to denial of service or arbitrary code execution. This issue arises from insufficient validation of attribute namespace removal operations, allowing unintended modification of critical object prototypes.",

[G-Rath]

Yes good catch, this suggestion should be applied

[Copilot]

The CVSS score was changed by removing the '/E:P' (Exploit Maturity: Proof of Concept) metric, but the severity was increased from LOW to MODERATE. Verify that the CVSS score calculation aligns with the MODERATE severity classification, as removing the exploit maturity metric while increasing severity seems inconsistent.

[G-Rath]

the original CVSS was considered invalid by the editor - I didn't change any of the supported toggles, I just had the editor recreate the score in a way it considered valid 🤷

[advisory-database]

Hi @G-Rath! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!