CVE-2025-55164 content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE
Prototype pollution in the content-security-policy-parser library allows attackers to override Object prototypes, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-55164?
CVE-2025-55164 is a high-severity code injection vulnerability in helmetjs content-security-policy-parser, published on 12 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called __proto__, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves disabling prototype method in NodeJS, neutralizing all possible prototype pollution attacks. Provide either --disable-proto=delete (recommended) or --disable-proto=throw as an argument to node to enable this feature.
Weakness: CWE-1321
Which versions are affected by CVE-2025-55164?
2 open source packages ship an affected version, including content-security-policy-parser.
| Package | Affected | Fixed in |
|---|---|---|
content-security-policy-parser npm | All versions | 0.6.0 |
content-security-policy-parser npm | All versions | 0.6.0 |
How do I fix CVE-2025-55164?
Upgrade content-security-policy-parser to 0.6.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-55164 being exploited?
There is no known exploitation of CVE-2025-55164 in the wild and no public exploit code.
Sources
Also known as GHSA-w2cq-g8g3-gm83.