CVE-2025-57348 (CNNVD-202509-3794)
中文标题:
Cube 安全漏洞
英文标题:
The node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype...
漏洞描述
中文描述:
Cube是Cube开源的一个构建数据应用程序的语义层。 Cube 5.0.0-beta.19及之前版本存在安全漏洞，该漏洞源于原型链初始化过程中对用户输入验证不当，可能导致拒绝服务或执行任意代码。
英文描述:
The node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype chain initialization, which could allow an attacker to inject properties into the prototype of built-in objects. This issue, categorized under CWE-1321, arises from improper validation of user-supplied input in the package's resource initialization process. Successful exploitation may lead to denial of service or arbitrary code execution in affected environments. The vulnerability affects versions up to and including 5.0.0-beta.19, and no official fix has been released to date.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| node-cube | node-cube | * | - | - |
cpe:2.3:a:node-cube:node-cube:*:*:*:*:*:node.js:*:*
|
| node-cube | node-cube | 5.0.0 | - | - |
cpe:2.3:a:node-cube:node-cube:5.0.0:beta0:*:*:*:node.js:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (adp)
MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-57348 |
2025-11-11 15:23:30 | 2025-11-11 07:40:44 |
| NVD | nvd_CVE-2025-57348 |
2025-11-11 15:01:04 | 2025-11-11 07:48:31 |
| CNNVD | cnnvd_CNNVD-202509-3794 |
2025-11-11 15:12:58 | 2025-11-11 08:00:13 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202509-3794
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 0 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']