CVE-2025-57321: Magix-Combine-Ex Project Magix-Combine-Ex

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.

Affected products

• Magix-Combine-Ex Project Magix-Combine-Ex: up to and including 1.2.10

Published 2025-09-24. Last modified 2026-06-17.