magix-combine-ex vulnerable to prototype pollution

CRITICAL 9.8CVE-2025-57321 · GHSA-cr7h-93fh-whwm · Published 24/09/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
magix-combine-ex magix-combine-ex_project	`≤ 1.2.10`	No fix yet
magix-combine-ex npm	`≤ 2.2.2`	No fix yet

Description

A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions through 2.2.2 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.

NVD description

A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.

References

nvd.nist.gov/vuln/detail/CVE-2025-57321 · ADVISORY
VulnSageAgent/PoCs · WEB
VulnSageAgent/PoCs · WEB
thx/magix-combine · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free