[GHSA-xfqm-j7pc-xrfc] messageformat has a prototype pollution vulnerability

[yusuke-koyoshi]

Updates

• Affected products
• CVSS v4
• Description
• Severity

Comments
The current advisory's version metadata does not match the actual fix history in the repository:

1. Affected range is off-by-one. The advisory lists < 2.3.0, but messageformat@2.3.0 itself contains the vulnerable Messages.addMessages() code path (identical to prior 2.x releases). The correct upper bound is < 3.0.0-beta.0.

2. "Patched: 3.0.0-beta.0" is misleading. In 3.0.0-beta.0 the vulnerable Messages class was relocated to a separate package (@messageformat/runtime), not fixed. The messageformat package is therefore no longer affected from 3.0.0-beta.0 onward, but the vulnerability continued to exist in @messageformat/runtime < 3.0.2.

3. Missing affected packages. The same vulnerable code is / was shipped in @messageformat/runtime (fixed in 3.0.2), @messageformat/icu-messageformat-1 (fixed in 0.12.0), @messageformat/fluent (fixed in 0.14.0), and the unmaintained legacy messageformat-runtime. These should be added as separate affected[] entries.

4. Actual fix reference. The real fix is commit 82cd10b4 (PR #464, 2025-10-30), which introduces _withNullPrototype() and replaces {} with Object.create(null) for keypath intermediates. Adding this as a reference would help downstream tooling.

5. 2.x is wontfix. Per maintainer comment on issue #452, the 2.x line will not be patched (deprecated since 2021). Users must upgrade to messageformat@4.0.0.

[Copilot]

Pull request overview

Updates the prototype-pollution advisory’s affected versions, scoring, and description.

Changes:

• Extends affected messageformat versions through 3.0.0-beta.0.
• Adds @messageformat/runtime versions before 3.0.2.
• Updates CVSS v4 scoring and severity.

Comments suppressed due to low confidence (3)

advisories/github-reviewed/2025/09/GHSA-xfqm-j7pc-xrfc/GHSA-xfqm-j7pc-xrfc.json:54

• The affected list still stops after @messageformat/runtime, although the PR description says this advisory must also cover @messageformat/icu-messageformat-1 (< 0.12.0), @messageformat/fluent (< 0.14.0), and the legacy messageformat-runtime package. Omitting those entries leaves users of three stated affected products undetected; add their separate affected[] ranges before closing this array.

      ]

advisories/github-reviewed/2025/09/GHSA-xfqm-j7pc-xrfc/GHSA-xfqm-j7pc-xrfc.json:10

• This changed description misidentifies the affected messageformat releases as an implementation of Unicode MessageFormat 2. The upstream v2.3.0 README documents ICU MessageFormat instead, so the advisory currently names the wrong specification.

  "details": "The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper handling of message key paths. The flaw arises when processing nested message keys containing special characters (e.g., __proto__ ), which can lead to unintended modification of the JavaScript Object prototype. This vulnerability may allow a remote attacker to inject properties into the global object prototype via specially crafted message input, potentially causing denial of service or other undefined behaviors in applications using the affected component.",

advisories/github-reviewed/2025/09/GHSA-xfqm-j7pc-xrfc/GHSA-xfqm-j7pc-xrfc.json:54

• The PR description explicitly says to add commit 82cd10b4 as the actual fix reference, but the unchanged references array still contains only the NVD advisory, issue #452, and package repository. Add the full commit URL (and preferably PR #464) so downstream users can trace the fix claimed by this update.

      ]

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.