Homepage

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') The advisory has been revoked - it doesn't affect any version of package automation-controller.src  (opens in a new tab)

Threat Intelligence

EPSS
0.1% (28th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-AUTOMATIONCONTROLLERSRC-15053249
  • published22 Jan 2026
  • disclosed24 Sept 2025
Report a new vulnerability Found a mistake?

Introduced: 24 Sep 2025

CVE-2025-57319  (opens in a new tab)
CWE-1321  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream automation-controller.src package and not the automation-controller.src package as distributed by RHEL.

fast-redact is a package that provides do very fast object redaction. A Prototype Pollution vulnerability in the nestedRestore function of fast-redact version 3.5.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. NOTE: the Supplier disputes this because the reporter only demonstrated access to properties by an internal utility function, and there is no means for achieving prototype pollution via the public API.