apidoc-core CVE-2025-13158

Exploitation requires that an application using apidoc-core (versions 0.2.0 and later) pass a malformed/attacker-influenced data structure - specifically one carrying a crafted 'define' property - into the preProcess() function of the api_group.js, api_param_title.js, api_use.js, or api_permission.js worker modules. The practical limiting factor is input provenance: apidoc-core normally parses developer-authored API documentation annotations, which are trusted build-time inputs, so real risk materializes only where an integrating application exposes this parsing to untrusted or externally-supplied data. No authentication is indicated by the provided vector (PR:N), and no user interaction is required (UI:N); impact is bounded to prototype-chain corruption effects (DoS / unintended behavior) rather than confirmed data theft.

The input assigns a Critical CVSS 4.0 base score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H), which on its face suggests remote, unauthenticated, no-interaction compromise of confidentiality, integrity, and availability. However, these signals should be treated with caution. No EPSS score, KEV listing, or POC was provided, so there is no public evidence of exploitation probability or active abuse - status is 'no public exploit identified at time of analysis.' More importantly, the CVSS impact metrics appear inflated relative to the description: CWE-1321 prototype pollution here 'potentially leads to denial of service or unintended behavior,' which maps far more naturally to availability/limited-integrity impact than to the full VC:H/VI:H/VA:H triad claimed. The AV:N rating is also questionable - apidoc-core is a Node.js documentation-generation library that parses developer-authored API annotation comments, which are normally trusted build-time inputs rather than remote attacker-controlled data; AV:N only holds if a downstream application feeds untrusted external input into the affected preProcess() functions. Net assessment: this is likely a high-CVSS-but-conditional-real-risk issue whose true severity depends entirely on whether an integrating application exposes apidoc-core parsing to untrusted input. Verify the intended data flow with the vendor advisory before treating it as a remotely exploitable priority.

An application that embeds apidoc-core and passes externally-supplied or untrusted data into its parsing pipeline receives a malformed data structure containing a crafted 'define' property. When preProcess() in api_group.js, api_param_title.js, api_use.js, or api_permission.js processes it, the attacker pollutes Object.prototype, degrading or crashing the application (DoS) or inducing unintended logic that relies on prototype-chain integrity. No public exploit code was identified at time of analysis.