Common Weakness Enumeration
CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
302 vulnerabilities reference this CWE, most recent first.
CVE-2026-91860 (GCVE-0-2026-91860)
Vulnerability from cvelistv5 – Published: 2026-09-30 13:13 – Updated: 2026-09-30 14:26
VLAI
EPSS
VEX
Title
Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge
Summary
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version
Vaadin 23.0.0 - 23.6.13
Vaadin 24.0.0 - 24.9.20
Vaadin 24.10.0 - 24.10.9
Vaadin 25.0.0 - 25.1.11
Vaadin 25.2.0 - 25.2.6
Mitigation
Upgrade to 23.6.14
Upgrade to 24.9.21
Upgrade to 24.10.10
Upgrade to 25.1.12
Upgrade to 25.2.7 or newer
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.
Artifacts
Maven coordinates Vulnerable versions Fixed version
com.vaadin:vaadin 23.0.0 - 23.6.13 >=23.6.14
com.vaadin:vaadin 24.0.0 - 24.9.20 >=24.9.21
com.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10
com.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12
com.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7
com.vaadin:vaadin-core 24.7.0 - 24.9.20 >=24.9.21
com.vaadin:vaadin-core 24.10.0 - 24.10.9 >=24.10.10
com.vaadin:vaadin-core 25.0.0 - 25.1.11 >=25.1.12
com.vaadin:vaadin-core 25.2.0 - 25.2.6 >=25.2.7
com.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 >=23.6.14
com.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 >=24.9.21
com.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 >=24.10.10
com.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 >=25.1.12
com.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 >=25.2.7
npm packages
npm package Vulnerable versions Fixed version
@vaadin/charts 23.0.0 - 23.6.4 >=23.6.5
@vaadin/charts 24.0.0 - 24.9.17 >=24.9.18
@vaadin/charts 24.10.0 - 24.10.4 >=24.10.5
@vaadin/charts 25.0.0 - 25.1.11 >=25.1.12
@vaadin/charts 25.2.0 - 25.2.8 >=25.2.9
@vaadin/component-base 24.7.0 - 24.9.17 >=24.9.18
@vaadin/component-base 24.10.0 - 24.10.4 >=24.10.5
@vaadin/component-base 25.0.0 - 25.1.11 >=25.1.12
@vaadin/component-base 25.2.0 - 25.2.8 >=25.2.9
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 14:26 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
Vaadin
CNA
References
7 references
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| vaadin | vaadin |
Affected:
23.0.0 , < 23.6.14
(maven)
Affected: 24.0.0 , < 24.9.21 (maven) Affected: 24.10.0 , < 24.10.10 (maven) Affected: 25.0.0 , < 25.1.12 (maven) Affected: 25.2.0 , < 25.2.7 (maven) |
|
| vaadin | vaadin-core |
Affected:
24.7.0 , < 24.9.21
(maven)
Affected: 24.10.0 , < 24.10.10 (maven) Affected: 25.0.0 , < 25.1.12 (maven) Affected: 25.2.0 , < 25.2.7 (maven) |
|
| vaadin | vaadin-charts-flow |
Affected:
23.0.0 , < 23.6.14
(maven)
Affected: 24.0.0 , < 24.9.21 (maven) Affected: 24.10.0 , < 24.10.10 (maven) Affected: 25.0.0 , < 25.1.12 (maven) Affected: 25.2.0 , < 25.2.7 (maven) |
|
| vaadin | @vaadin/charts |
Affected:
23.0.0 , < 23.6.5
(semver)
Affected: 24.0.0 , < 24.9.18 (semver) Affected: 24.10.0 , < 24.10.5 (semver) Affected: 25.0.0 , < 25.1.12 (semver) Affected: 25.2.0 , < 25.2.9 (semver) |
|
| vaadin | @vaadin/component-base |
Affected:
24.7.0 , < 24.9.18
(semver)
Affected: 24.10.0 , < 24.10.5 (semver) Affected: 25.0.0 , < 25.1.12 (semver) Affected: 25.2.0 , < 25.2.9 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T14:26:16.234947Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T14:26:23.618Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "com.vaadin:vaadin",
"product": "vaadin",
"repo": "https://github.com/vaadin/platform",
"vendor": "vaadin",
"versions": [
{
"lessThan": "23.6.14",
"status": "affected",
"version": "23.0.0",
"versionType": "maven"
},
{
"lessThan": "24.9.21",
"status": "affected",
"version": "24.0.0",
"versionType": "maven"
},
{
"lessThan": "24.10.10",
"status": "affected",
"version": "24.10.0",
"versionType": "maven"
},
{
"lessThan": "25.1.12",
"status": "affected",
"version": "25.0.0",
"versionType": "maven"
},
{
"lessThan": "25.2.7",
"status": "affected",
"version": "25.2.0",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "com.vaadin:vaadin-core",
"product": "vaadin-core",
"repo": "https://github.com/vaadin/platform",
"vendor": "vaadin",
"versions": [
{
"lessThan": "24.9.21",
"status": "affected",
"version": "24.7.0",
"versionType": "maven"
},
{
"lessThan": "24.10.10",
"status": "affected",
"version": "24.10.0",
"versionType": "maven"
},
{
"lessThan": "25.1.12",
"status": "affected",
"version": "25.0.0",
"versionType": "maven"
},
{
"lessThan": "25.2.7",
"status": "affected",
"version": "25.2.0",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "com.vaadin:vaadin-charts-flow",
"product": "vaadin-charts-flow",
"repo": "https://github.com/vaadin/flow-components",
"vendor": "vaadin",
"versions": [
{
"lessThan": "23.6.14",
"status": "affected",
"version": "23.0.0",
"versionType": "maven"
},
{
"lessThan": "24.9.21",
"status": "affected",
"version": "24.0.0",
"versionType": "maven"
},
{
"lessThan": "24.10.10",
"status": "affected",
"version": "24.10.0",
"versionType": "maven"
},
{
"lessThan": "25.1.12",
"status": "affected",
"version": "25.0.0",
"versionType": "maven"
},
{
"lessThan": "25.2.7",
"status": "affected",
"version": "25.2.0",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://registry.npmjs.org",
"defaultStatus": "unaffected",
"packageName": "@vaadin/charts",
"product": "@vaadin/charts",
"repo": "https://github.com/vaadin/web-components",
"vendor": "vaadin",
"versions": [
{
"lessThan": "23.6.5",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "24.9.18",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
},
{
"lessThan": "24.10.5",
"status": "affected",
"version": "24.10.0",
"versionType": "semver"
},
{
"lessThan": "25.1.12",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
},
{
"lessThan": "25.2.9",
"status": "affected",
"version": "25.2.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://registry.npmjs.org",
"defaultStatus": "unaffected",
"packageName": "@vaadin/component-base",
"product": "@vaadin/component-base",
"repo": "https://github.com/vaadin/web-components",
"vendor": "vaadin",
"versions": [
{
"lessThan": "24.9.18",
"status": "affected",
"version": "24.7.0",
"versionType": "semver"
},
{
"lessThan": "24.10.5",
"status": "affected",
"version": "24.10.0",
"versionType": "semver"
},
{
"lessThan": "25.1.12",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
},
{
"lessThan": "25.2.9",
"status": "affected",
"version": "25.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ridwan Arefin Islam, Madiba Security Lab, Concordia University"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgba(232, 232, 232, 0.04);\"\u003eA prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component\u0027s i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003eUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\u003cbr\u003e\u003cbr\u003eProduct version\u003cbr\u003eVaadin 23.0.0 - 23.6.13\u003cbr\u003eVaadin 24.0.0 - 24.9.20\u003cbr\u003eVaadin 24.10.0 - 24.10.9\u003cbr\u003eVaadin 25.0.0 - 25.1.11\u003cbr\u003eVaadin 25.2.0 - 25.2.6\u003cbr\u003e\u003cbr\u003eMitigation\u003cbr\u003eUpgrade to 23.6.14\u003cbr\u003eUpgrade to 24.9.21\u003cbr\u003eUpgrade to 24.10.10\u003cbr\u003eUpgrade to 25.1.12\u003cbr\u003eUpgrade to 25.2.7 or newer\u003cbr\u003e\u003cbr\u003ePlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.\u003cbr\u003e\u003cbr\u003eArtifacts\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eMaven coordinates\u003c/td\u003e\u003ctd\u003eVulnerable versions\u003c/td\u003e\u003ctd\u003eFixed version\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e23.0.0 - 23.6.13\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;23.6.14\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.0.0 - 24.9.20\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.9.21\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.10.0 - 24.10.9\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.10.10\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.0.0 - 25.1.11\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.1.12\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.2.0 - 25.2.6\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.2.7\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-core\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.7.0 - 24.9.20\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.9.21\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-core\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.10.0 - 24.10.9\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.10.10\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-core\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.0.0 - 25.1.11\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.1.12\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-core\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.2.0 - 25.2.6\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.2.7\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-charts-flow\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e23.0.0 - 23.6.13\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;23.6.14\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-charts-flow\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.0.0 - 24.9.20\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.9.21\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-charts-flow\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.10.0 - 24.10.9\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.10.10\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-charts-flow\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.0.0 - 25.1.11\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.1.12\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-charts-flow\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.2.0 - 25.2.6\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.2.7\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cbr\u003e\u003cbr\u003enpm packages\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003enpm package\u003c/td\u003e\u003ctd\u003eVulnerable versions\u003c/td\u003e\u003ctd\u003eFixed version\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/charts\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e23.0.0 - 23.6.4\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;23.6.5\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/charts\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.0.0 - 24.9.17\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.9.18\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/charts\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.10.0 - 24.10.4\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.10.5\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/charts\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.0.0 - 25.1.11\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.1.12\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/charts\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.2.0 - 25.2.8\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.2.9\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/component-base\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.7.0 - 24.9.17\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.9.18\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/component-base\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.10.0 - 24.10.4\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.10.5\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/component-base\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.0.0 - 25.1.11\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.1.12\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/component-base\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.2.0 - 25.2.8\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.2.9\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cbr\u003e\u003c/span\u003e"
}
],
"value": "A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component\u0027s i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 23.0.0 - 23.6.13\nVaadin 24.0.0 - 24.9.20\nVaadin 24.10.0 - 24.10.9\nVaadin 25.0.0 - 25.1.11\nVaadin 25.2.0 - 25.2.6\n\nMitigation\nUpgrade to 23.6.14\nUpgrade to 24.9.21\nUpgrade to 24.10.10\nUpgrade to 25.1.12\nUpgrade to 25.2.7 or newer\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.\n\nArtifacts\nMaven coordinates Vulnerable versions Fixed version\ncom.vaadin:vaadin 23.0.0 - 23.6.13 \u003e=23.6.14\ncom.vaadin:vaadin 24.0.0 - 24.9.20 \u003e=24.9.21\ncom.vaadin:vaadin 24.10.0 - 24.10.9 \u003e=24.10.10\ncom.vaadin:vaadin 25.0.0 - 25.1.11 \u003e=25.1.12\ncom.vaadin:vaadin 25.2.0 - 25.2.6 \u003e=25.2.7\ncom.vaadin:vaadin-core 24.7.0 - 24.9.20 \u003e=24.9.21\ncom.vaadin:vaadin-core 24.10.0 - 24.10.9 \u003e=24.10.10\ncom.vaadin:vaadin-core 25.0.0 - 25.1.11 \u003e=25.1.12\ncom.vaadin:vaadin-core 25.2.0 - 25.2.6 \u003e=25.2.7\ncom.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 \u003e=23.6.14\ncom.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 \u003e=24.9.21\ncom.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 \u003e=24.10.10\ncom.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 \u003e=25.1.12\ncom.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 \u003e=25.2.7\n\nnpm packages\nnpm package Vulnerable versions Fixed version\n@vaadin/charts 23.0.0 - 23.6.4 \u003e=23.6.5\n@vaadin/charts 24.0.0 - 24.9.17 \u003e=24.9.18\n@vaadin/charts 24.10.0 - 24.10.4 \u003e=24.10.5\n@vaadin/charts 25.0.0 - 25.1.11 \u003e=25.1.12\n@vaadin/charts 25.2.0 - 25.2.8 \u003e=25.2.9\n@vaadin/component-base 24.7.0 - 24.9.17 \u003e=24.9.18\n@vaadin/component-base 24.10.0 - 24.10.4 \u003e=24.10.5\n@vaadin/component-base 25.0.0 - 25.1.11 \u003e=25.1.12\n@vaadin/component-base 25.2.0 - 25.2.8 \u003e=25.2.9"
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "AUTOMATIC",
"Safety": "NEGLIGIBLE",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "CLEAR",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T13:13:05.996Z",
"orgId": "9e0f3122-90e9-42d5-93de-8c6b98deef7e",
"shortName": "Vaadin"
},
"references": [
{
"url": "https://vaadin.com/security/cve-2026-91860"
},
{
"url": "https://github.com/vaadin/web-components/pull/12483"
},
{
"url": "https://github.com/vaadin/web-components/pull/12492"
},
{
"url": "https://github.com/vaadin/web-components/pull/12493"
},
{
"url": "https://github.com/vaadin/web-components/pull/12494"
},
{
"url": "https://github.com/vaadin/web-components/pull/12496"
},
{
"url": "https://github.com/vaadin/web-components/pull/12559"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cb\u003e\u003cspan style=\"background-color: transparent;\"\u003eUsers of affected versions should apply the following mitigation or upgrade.\u003c/span\u003e\u003c/b\u003e\u003cbr\u003e"
}
],
"value": "Users of affected versions should apply the following mitigation or upgrade."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9e0f3122-90e9-42d5-93de-8c6b98deef7e",
"assignerShortName": "Vaadin",
"cveId": "CVE-2026-91860",
"datePublished": "2026-09-30T13:13:05.996Z",
"dateReserved": "2026-09-15T09:33:38.900Z",
"dateUpdated": "2026-09-30T14:26:23.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90771 (GCVE-0-2026-90771)
Vulnerability from cvelistv5 – Published: 2026-09-13 10:45 – Updated: 2026-09-24 14:21
VLAI
EPSS
VEX
Title
joi before 17.13.8 and 18.2.9 Prototype Pollution via messages
Summary
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:02 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/issues/3150 | issue-tracking |
| https://github.com/hapijs/joi | product |
| https://github.com/hapijs/joi/blob/v18.2.8/lib/me… | technical-description |
| https://github.com/hapijs/joi/commit/5b8333c9177e… | patch |
| https://www.vulncheck.com/advisories/joi-before-1… | third-party-advisory |
Impacted products
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90771",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:02:28.580545Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:03:23.974Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/hapijs/joi/issues/3150"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/joi",
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"lessThan": "17.13.8",
"status": "affected",
"version": "16.0.0",
"versionType": "semver"
},
{
"lessThan": "18.2.9",
"status": "affected",
"version": "18.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object\u0027s prototype, breaking downstream code relying on Object.prototype methods."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:21:52.339Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #3150",
"tags": [
"issue-tracking"
],
"url": "https://github.com/hapijs/joi/issues/3150"
},
{
"tags": [
"product"
],
"url": "https://github.com/hapijs/joi"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js"
},
{
"tags": [
"patch"
],
"url": "https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb"
},
{
"name": "VulnCheck Advisory: joi before 17.13.8 and 18.2.9 Prototype Pollution via messages",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages"
}
],
"title": "joi before 17.13.8 and 18.2.9 Prototype Pollution via messages",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-90771",
"datePublished": "2026-09-13T10:45:42.498Z",
"dateReserved": "2026-09-13T10:14:57.680Z",
"dateUpdated": "2026-09-24T14:21:52.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89011 (GCVE-0-2026-89011)
Vulnerability from cvelistv5 – Published: 2026-09-10 19:56 – Updated: 2026-11-08 14:09 X_Open Source
VLAI
EPSS
VEX
Title
isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo
Summary
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref negotiation. Attackers controlling a Git server can advertise a specially crafted ref such as '__proto__/corsProxy' to reroute all subsequent network operations through an attacker-controlled proxy, causing isomorphic-git to invoke the victim's onAuth callback and transmit credentials to the attacker when the victim calls getRemoteInfo with an attacker-supplied URL.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 17:09 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/isomorphic-git/isomorphic-git/… | vendor-advisory |
| https://github.com/isomorphic-git/isomorphic-git/… | release-notes |
| https://github.com/isomorphic-git/isomorphic-git/… | issue-trackingpatch |
| https://github.com/isomorphic-git/isomorphic-git/… | patch |
| https://www.vulncheck.com/advisories/isomorphic-g… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| isomorphic-git | isomorphic-git |
Affected:
0 , < 1.42.0
(semver)
|
Date Public
2026-09-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89011",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T17:09:25.363378Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T20:32:36.479Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/isomorphic-git/isomorphic-git",
"product": "isomorphic-git",
"repo": "https://github.com/isomorphic-git/isomorphic-git",
"vendor": "isomorphic-git",
"versions": [
{
"lessThan": "1.42.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Isabel Mill"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulnCheck"
}
],
"datePublic": "2026-09-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing \u0027__proto__\u0027 path segments during ref negotiation. Attackers controlling a Git server can advertise a specially crafted ref such as \u0027__proto__/corsProxy\u0027 to reroute all subsequent network operations through an attacker-controlled proxy, causing isomorphic-git to invoke the victim\u0027s onAuth callback and transmit credentials to the attacker when the victim calls getRemoteInfo with an attacker-supplied URL."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T14:09:19.711Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-83vg-jxvh-fx76)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-83vg-jxvh-fx76"
},
{
"name": "isomorphic-git 1.42.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.42.0"
},
{
"name": "Pull Request",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/isomorphic-git/isomorphic-git/pull/2426"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/isomorphic-git/isomorphic-git/commit/b3db111885230bac9a648e0a2312c65ca66f76eb"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/isomorphic-git-prototype-pollution-via-getremoteinfo"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "isomorphic-git \u003c 1.42.0 Prototype Pollution via getRemoteInfo",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-89011",
"datePublished": "2026-09-10T19:56:25.335Z",
"dateReserved": "2026-09-10T16:23:54.470Z",
"dateUpdated": "2026-11-08T14:09:19.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86536 (GCVE-0-2026-86536)
Vulnerability from cvelistv5 – Published: 2026-10-02 11:40 – Updated: 2026-10-02 17:31
VLAI
EPSS
VEX
Title
Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript
Summary
Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-02 17:31 UTC
CWE
- CWE-1321 - Improperly controlled modification of object prototype attributes ('prototype pollution')
Assigner
apache
CNA
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/33otcgbqd27wf6qq8… | vendor-advisory |
| https://lists.apache.org/thread/xckvfky30kdnk8vqn… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Thrift |
Affected:
0 , < 0.25.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86536",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-02T17:31:18.825512Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T17:31:43.876Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://registry.npmjs.org",
"defaultStatus": "unaffected",
"packageName": "thrift",
"packageURL": "pkg:npm/thrift",
"product": "Apache Thrift",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.25.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "javascript bindings",
"product": "Apache Thrift",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.25.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "typescript bindings",
"product": "Apache Thrift",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.25.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Thrift."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027) vulnerability in Apache Thrift all JS bindings.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Thrift: before 0.25.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027) vulnerability in Apache Thrift all JS bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T11:40:06.911Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/xckvfky30kdnk8vqnhy0wndthvc9nymp"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object\u0027s prototype in generated JavaScript",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-86536",
"datePublished": "2026-10-02T11:40:06.911Z",
"dateReserved": "2026-09-07T22:00:32.242Z",
"dateUpdated": "2026-10-02T17:31:43.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86535 (GCVE-0-2026-86535)
Vulnerability from cvelistv5 – Published: 2026-10-02 11:38 – Updated: 2026-10-02 17:31
VLAI
EPSS
VEX
Title
Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely
Summary
Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-02 17:30 UTC
CWE
Assigner
apache
CNA
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/33otcgbqd27wf6qq8… | vendor-advisory |
| https://lists.apache.org/thread/94cvvzzl0rh707bn2… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Thrift |
Affected:
0 , < 0.25.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86535",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-02T17:30:50.294328Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T17:31:02.660Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://registry.npmjs.org",
"defaultStatus": "unaffected",
"packageName": "thrift",
"packageURL": "pkg:npm/thrift",
"product": "Apache Thrift",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.25.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Thrift."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eLoop with unreachable exit condition (\u0027infinite loop\u0027), Improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027) vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Thrift: before 0.25.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.25.0, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Loop with unreachable exit condition (\u0027infinite loop\u0027), Improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027) vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with unreachable exit condition (\u0027infinite loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T11:38:16.628Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/94cvvzzl0rh707bn2j4zt844v547508g"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache Thrift: A JSON member name can stall the Node server\u0027s event loop indefinitely",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-86535",
"datePublished": "2026-10-02T11:38:16.628Z",
"dateReserved": "2026-09-07T21:54:34.055Z",
"dateUpdated": "2026-10-02T17:31:02.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86078 (GCVE-0-2026-86078)
Vulnerability from cvelistv5 – Published: 2026-09-08 21:27 – Updated: 2026-09-09 16:03
VLAI
EPSS
VEX
Title
n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
Summary
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain __proto__ or constructor, causing nested writes to reach Object.prototype in the main n8n process and disrupt later requests. The affected function is summarizeWorkflowStructure in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts. This issue is fixed in versions 2.37.7 and 2.38.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:49 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/n8n-io/n8n/security/advisories… | x_refsource_CONFIRM |
| https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 | x_refsource_MISC |
| https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86078",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:49:54.950085Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:03:58.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"status": "affected",
"version": "\u003c 2.37.7"
},
{
"status": "affected",
"version": "\u003e= 2.38.0, \u003c 2.38.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain __proto__ or constructor, causing nested writes to reach Object.prototype in the main n8n process and disrupt later requests. The affected function is summarizeWorkflowStructure in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts. This issue is fixed in versions 2.37.7 and 2.38.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T21:27:21.351Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/n8n-io/n8n/security/advisories/GHSA-679f-58pq-4v2c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-679f-58pq-4v2c"
},
{
"name": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7"
},
{
"name": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2"
}
],
"source": {
"advisory": "GHSA-679f-58pq-4v2c",
"discovery": "UNKNOWN"
},
"title": "n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86078",
"datePublished": "2026-09-08T21:27:21.351Z",
"dateReserved": "2026-09-04T19:34:03.100Z",
"dateUpdated": "2026-09-09T16:03:58.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85625 (GCVE-0-2026-85625)
Vulnerability from cvelistv5 – Published: 2026-09-04 14:32 – Updated: 2026-09-14 19:33
VLAI
EPSS
VEX
Title
sift 17.1.3 Prototype Pollution Remote Code Execution via $where
Summary
sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:20 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/crcn/sift.js/issues/276 | issue-tracking |
| https://github.com/crcn/sift.js | product |
| https://github.com/crcn/sift.js/blob/v17.1.3/src/… | technical-description |
| https://www.vulncheck.com/advisories/sift-17.1.3-… | third-party-advisory |
Date Public
2026-07-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85625",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:20:21.665008Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:33:09.188Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/sift",
"product": "sift.js",
"vendor": "crcn",
"versions": [
{
"lessThanOrEqual": "17.1.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T14:32:15.388Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #276",
"tags": [
"issue-tracking"
],
"url": "https://github.com/crcn/sift.js/issues/276"
},
{
"tags": [
"product"
],
"url": "https://github.com/crcn/sift.js"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/crcn/sift.js/blob/v17.1.3/src/core.ts"
},
{
"name": "VulnCheck Advisory: sift 17.1.3 Prototype Pollution Remote Code Execution via $where",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sift-17.1.3-prototype-pollution-remote-code-execution-via-where"
}
],
"title": "sift 17.1.3 Prototype Pollution Remote Code Execution via $where",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85625",
"datePublished": "2026-09-04T14:32:15.388Z",
"dateReserved": "2026-09-04T11:03:33.316Z",
"dateUpdated": "2026-09-14T19:33:09.188Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85063 (GCVE-0-2026-85063)
Vulnerability from cvelistv5 – Published: 2026-09-03 20:32 – Updated: 2026-09-04 17:44
VLAI
EPSS
VEX
Title
node-csv: Prototype replacement still reachable via columns path
Summary
node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name options enabled treats a duplicate __proto__ header as an existing property in packages/csv-parse/lib/api/index.js, assigns an attacker-controlled array through obj['__proto__'], and replaces the parsed record object's prototype. A malicious CSV header can therefore inject inherited array values into the returned record, hide those inherited values from JSON serialization, and affect property enumeration and type or shape checks in applications that process the record. This issue is fixed in version 7.0.2.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 17:43 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/adaltas/node-csv/security/advi… | x_refsource_CONFIRM |
| https://github.com/adaltas/node-csv/issues/496 | x_refsource_MISC |
| https://github.com/adaltas/node-csv/pull/497 | x_refsource_MISC |
| https://github.com/adaltas/node-csv/commit/eb4d14… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85063",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T17:43:46.602742Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:44:08.340Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/adaltas/node-csv/issues/496"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "node-csv",
"vendor": "adaltas",
"versions": [
{
"status": "affected",
"version": "\u003c 7.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name options enabled treats a duplicate __proto__ header as an existing property in packages/csv-parse/lib/api/index.js, assigns an attacker-controlled array through obj[\u0027__proto__\u0027], and replaces the parsed record object\u0027s prototype. A malicious CSV header can therefore inject inherited array values into the returned record, hide those inherited values from JSON serialization, and affect property enumeration and type or shape checks in applications that process the record. This issue is fixed in version 7.0.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T20:32:46.145Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/adaltas/node-csv/security/advisories/GHSA-8cw4-87c7-c6xx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/adaltas/node-csv/security/advisories/GHSA-8cw4-87c7-c6xx"
},
{
"name": "https://github.com/adaltas/node-csv/issues/496",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adaltas/node-csv/issues/496"
},
{
"name": "https://github.com/adaltas/node-csv/pull/497",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adaltas/node-csv/pull/497"
},
{
"name": "https://github.com/adaltas/node-csv/commit/eb4d1484589c976dcb977db8dd0b90e015a6f66e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adaltas/node-csv/commit/eb4d1484589c976dcb977db8dd0b90e015a6f66e"
}
],
"source": {
"advisory": "GHSA-8cw4-87c7-c6xx",
"discovery": "UNKNOWN"
},
"title": "node-csv: Prototype replacement still reachable via columns path"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85063",
"datePublished": "2026-09-03T20:32:46.145Z",
"dateReserved": "2026-09-02T21:21:01.774Z",
"dateUpdated": "2026-09-04T17:44:08.340Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84368 (GCVE-0-2026-84368)
Vulnerability from cvelistv5 – Published: 2026-09-01 20:36 – Updated: 2026-09-02 12:18
VLAI
EPSS
VEX
Title
joi: Prototype pollution via a `__proto__` language key in custom messages
Summary
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 12:11 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
GitHub_M
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/security/advisories… | x_refsource_CONFIRM |
| https://github.com/hapijs/joi/pull/3138 | x_refsource_MISC |
| https://github.com/hapijs/joi/pull/3139 | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/8d0b808f3e87… | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/90d07571923c… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84368",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T12:11:08.547444Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T12:18:07.627Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c= 17.1.1"
},
{
"status": "affected",
"version": "\u003e= 17.2.0, \u003c 17.13.6"
},
{
"status": "affected",
"version": "\u003e= 18.0.0, \u003c 18.2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function\u0027s static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T20:36:51.859Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr"
},
{
"name": "https://github.com/hapijs/joi/pull/3138",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3138"
},
{
"name": "https://github.com/hapijs/joi/pull/3139",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3139"
},
{
"name": "https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36"
},
{
"name": "https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa"
}
],
"source": {
"advisory": "GHSA-6w3j-5fw6-r9vr",
"discovery": "UNKNOWN"
},
"title": "joi: Prototype pollution via a `__proto__` language key in custom messages"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84368",
"datePublished": "2026-09-01T20:36:51.859Z",
"dateReserved": "2026-09-01T16:27:58.129Z",
"dateUpdated": "2026-09-02T12:18:07.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84367 (GCVE-0-2026-84367)
Vulnerability from cvelistv5 – Published: 2026-09-01 20:33 – Updated: 2026-09-03 15:58
VLAI
EPSS
VEX
Title
joi: object().rename() with a template target can set the validated object's prototype
Summary
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 15:58 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
GitHub_M
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/security/advisories… | x_refsource_CONFIRM |
| https://github.com/hapijs/joi/pull/3134 | x_refsource_MISC |
| https://github.com/hapijs/joi/pull/3135 | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/162f367aa178… | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/172ececa192f… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84367",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T15:58:17.940373Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T15:58:42.656Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 17.13.5"
},
{
"status": "affected",
"version": "\u003e= 18.0.0, \u003c 18.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi\u0027s lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern\u0027s own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T20:33:29.295Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc"
},
{
"name": "https://github.com/hapijs/joi/pull/3134",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3134"
},
{
"name": "https://github.com/hapijs/joi/pull/3135",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3135"
},
{
"name": "https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6"
},
{
"name": "https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01"
}
],
"source": {
"advisory": "GHSA-gg4h-3hg2-grpc",
"discovery": "UNKNOWN"
},
"title": "joi: object().rename() with a template target can set the validated object\u0027s prototype"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84367",
"datePublished": "2026-09-01T20:33:29.295Z",
"dateReserved": "2026-09-01T16:27:58.129Z",
"dateUpdated": "2026-09-03T15:58:42.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
Architecture and Design
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Implementation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
Implementation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Implementation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.