Common Weakness Enumeration
CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
952 vulnerabilities reference this CWE, most recent first.
CVE-2026-93753 (GCVE-0-2026-93753)
Vulnerability from cvelistv5 – Published: 2026-09-18 17:51 – Updated: 2026-09-24 14:23
VLAI
EPSS
VEX
Title
deepmerge through 4.3.1 Prototype Poisoning via mergeObject
Summary
deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object's prototype, causing applications to inherit unintended values when accessing properties without own-property checks.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:16 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/TehShrike/deepmerge/issues/273 | issue-tracking |
| https://github.com/TehShrike/deepmerge | product |
| https://github.com/TehShrike/deepmerge/blob/5b877… | technical-description |
| https://www.vulncheck.com/advisories/deepmerge-th… | third-party-advisory |
Impacted products
Date Public
2026-09-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93753",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:16:56.102337Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:17:03.727Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/TehShrike/deepmerge/issues/273"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/deepmerge",
"product": "deepmerge",
"vendor": "TehShrike",
"versions": [
{
"lessThanOrEqual": "4.3.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wayde Shi (PayPal Cyber Security Team)"
}
],
"datePublic": "2026-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned object\u0027s prototype, causing applications to inherit unintended values when accessing properties without own-property checks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:23:12.090Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #273",
"tags": [
"issue-tracking"
],
"url": "https://github.com/TehShrike/deepmerge/issues/273"
},
{
"tags": [
"product"
],
"url": "https://github.com/TehShrike/deepmerge"
},
{
"name": "propertyIsUnsafe() target-shape guard and the ungated target copy loop",
"tags": [
"technical-description"
],
"url": "https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60"
},
{
"name": "VulnCheck Advisory: deepmerge through 4.3.1 Prototype Poisoning via mergeObject",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject"
}
],
"title": "deepmerge through 4.3.1 Prototype Poisoning via mergeObject",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93753",
"datePublished": "2026-09-18T17:51:37.794Z",
"dateReserved": "2026-09-18T16:30:18.853Z",
"dateUpdated": "2026-09-24T14:23:12.090Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92781 (GCVE-0-2026-92781)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-21 15:50
VLAI
EPSS
VEX
Title
Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes
Summary
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with __proto__ or prototype segments to pollute Object.prototype in a visitor's browser when the SDK processes the malicious URL.
Severity
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 15:50 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/BuilderIO/builder/issues/4824 | issue-tracking |
| https://github.com/BuilderIO/builder | product |
| https://github.com/BuilderIO/builder/blob/main/pa… | technical-description |
| https://github.com/BuilderIO/builder/blob/main/pa… | technical-description |
| https://www.vulncheck.com/advisories/builder-io-g… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| BuilderIO | @builder.io/sdk-react |
Affected:
0 , ≤ 5.2.11
(semver)
|
|
| BuilderIO | @builder.io/sdk-vue |
Affected:
0 , ≤ 5.2.11
(semver)
|
|
| BuilderIO | @builder.io/sdk-svelte |
Affected:
0 , ≤ 5.2.11
(semver)
|
|
| BuilderIO | @builder.io/sdk-solid |
Affected:
0 , ≤ 5.2.11
(semver)
|
|
| BuilderIO | @builder.io/sdk-qwik |
Affected:
0 , ≤ 0.25.13
(semver)
|
|
| BuilderIO | @builder.io/sdk-angular |
Affected:
0 , ≤ 0.25.13
(semver)
|
|
| BuilderIO | @builder.io/sdk-react-nextjs |
Affected:
0 , ≤ 0.25.13
(semver)
|
Date Public
2026-08-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92781",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:50:07.571574Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:50:13.299Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/BuilderIO/builder/issues/4824"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40builder.io/sdk-react",
"product": "@builder.io/sdk-react",
"vendor": "BuilderIO",
"versions": [
{
"lessThanOrEqual": "5.2.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40builder.io/sdk-vue",
"product": "@builder.io/sdk-vue",
"vendor": "BuilderIO",
"versions": [
{
"lessThanOrEqual": "5.2.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40builder.io/sdk-svelte",
"product": "@builder.io/sdk-svelte",
"vendor": "BuilderIO",
"versions": [
{
"lessThanOrEqual": "5.2.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40builder.io/sdk-solid",
"product": "@builder.io/sdk-solid",
"vendor": "BuilderIO",
"versions": [
{
"lessThanOrEqual": "5.2.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40builder.io/sdk-qwik",
"product": "@builder.io/sdk-qwik",
"vendor": "BuilderIO",
"versions": [
{
"lessThanOrEqual": "0.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40builder.io/sdk-angular",
"product": "@builder.io/sdk-angular",
"vendor": "BuilderIO",
"versions": [
{
"lessThanOrEqual": "0.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40builder.io/sdk-react-nextjs",
"product": "@builder.io/sdk-react-nextjs",
"vendor": "BuilderIO",
"versions": [
{
"lessThanOrEqual": "0.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-08-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with __proto__ or prototype segments to pollute Object.prototype in a visitor\u0027s browser when the SDK processes the malicious URL."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:38.923Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #4824",
"tags": [
"issue-tracking"
],
"url": "https://github.com/BuilderIO/builder/issues/4824"
},
{
"tags": [
"product"
],
"url": "https://github.com/BuilderIO/builder"
},
{
"name": "builder.userAttributes parameters are expanded through unflatten",
"tags": [
"technical-description"
],
"url": "https://github.com/BuilderIO/builder/blob/main/packages/sdks/src/functions/get-content/generate-content-url.ts"
},
{
"name": "unflatten walks the dotted key path with no prototype guard",
"tags": [
"technical-description"
],
"url": "https://github.com/BuilderIO/builder/blob/main/packages/sdks/src/helpers/flatten.ts#L60-L76"
},
{
"name": "VulnCheck Advisory: Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/builder-io-gen2-sdks-through-5.2.11-prototype-pollution-via-builder-userattributes"
}
],
"title": "Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92781",
"datePublished": "2026-09-16T20:32:38.923Z",
"dateReserved": "2026-09-16T19:22:53.825Z",
"dateUpdated": "2026-09-21T15:50:13.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92779 (GCVE-0-2026-92779)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-17 19:25
VLAI
EPSS
VEX
Title
Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings
Summary
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:16 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/BuilderIO/builder/issues/4823 | issue-tracking |
| https://github.com/BuilderIO/builder | product |
| https://github.com/BuilderIO/builder/blob/main/pa… | technical-description |
| https://github.com/BuilderIO/builder/blob/main/pa… | technical-description |
| https://www.vulncheck.com/advisories/builder-io-g… | third-party-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| BuilderIO | @builder.io/sdk-react |
Affected:
0 , ≤ 5.2.11
(semver)
|
|
| BuilderIO | @builder.io/sdk-vue |
Affected:
0 , ≤ 5.2.11
(semver)
|
|
| BuilderIO | @builder.io/sdk-svelte |
Affected:
0 , ≤ 5.2.11
(semver)
|
|
| BuilderIO | @builder.io/sdk-solid |
Affected:
0 , ≤ 5.2.11
(semver)
|
|
| BuilderIO | @builder.io/sdk-qwik |
Affected:
0 , ≤ 0.25.13
(semver)
|
|
| BuilderIO | @builder.io/sdk-angular |
Affected:
0 , ≤ 0.25.13
(semver)
|
|
| BuilderIO | @builder.io/sdk-react-nextjs |
Affected:
0 , ≤ 0.25.13
(semver)
|
Date Public
2026-08-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92779",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:16:56.428687Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:25:04.694Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40builder.io/sdk-react",
"product": "@builder.io/sdk-react",
"vendor": "BuilderIO",
"versions": [
{
"lessThanOrEqual": "5.2.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40builder.io/sdk-vue",
"product": "@builder.io/sdk-vue",
"vendor": "BuilderIO",
"versions": [
{
"lessThanOrEqual": "5.2.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40builder.io/sdk-svelte",
"product": "@builder.io/sdk-svelte",
"vendor": "BuilderIO",
"versions": [
{
"lessThanOrEqual": "5.2.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40builder.io/sdk-solid",
"product": "@builder.io/sdk-solid",
"vendor": "BuilderIO",
"versions": [
{
"lessThanOrEqual": "5.2.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40builder.io/sdk-qwik",
"product": "@builder.io/sdk-qwik",
"vendor": "BuilderIO",
"versions": [
{
"lessThanOrEqual": "0.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40builder.io/sdk-angular",
"product": "@builder.io/sdk-angular",
"vendor": "BuilderIO",
"versions": [
{
"lessThanOrEqual": "0.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40builder.io/sdk-react-nextjs",
"product": "@builder.io/sdk-react-nextjs",
"vendor": "BuilderIO",
"versions": [
{
"lessThanOrEqual": "0.25.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-08-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants\u0027 renders."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:37.544Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #4823",
"tags": [
"issue-tracking"
],
"url": "https://github.com/BuilderIO/builder/issues/4823"
},
{
"tags": [
"product"
],
"url": "https://github.com/BuilderIO/builder"
},
{
"name": "binding keys from content JSON are used as the write path",
"tags": [
"technical-description"
],
"url": "https://github.com/BuilderIO/builder/blob/main/packages/sdks/src/functions/get-processed-block.ts#L84-L93"
},
{
"name": "the deep-set helper has no __proto__ guard",
"tags": [
"technical-description"
],
"url": "https://github.com/BuilderIO/builder/blob/main/packages/sdks/src/functions/set.ts#L7-L26"
},
{
"name": "VulnCheck Advisory: Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/builder-io-gen2-sdks-through-5.2.11-prototype-pollution-via-bindings"
}
],
"title": "Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92779",
"datePublished": "2026-09-16T20:32:37.544Z",
"dateReserved": "2026-09-16T19:22:53.082Z",
"dateUpdated": "2026-09-17T19:25:04.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91860 (GCVE-0-2026-91860)
Vulnerability from cvelistv5 – Published: 2026-09-30 13:13 – Updated: 2026-09-30 14:26
VLAI
EPSS
VEX
Title
Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge
Summary
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version
Vaadin 23.0.0 - 23.6.13
Vaadin 24.0.0 - 24.9.20
Vaadin 24.10.0 - 24.10.9
Vaadin 25.0.0 - 25.1.11
Vaadin 25.2.0 - 25.2.6
Mitigation
Upgrade to 23.6.14
Upgrade to 24.9.21
Upgrade to 24.10.10
Upgrade to 25.1.12
Upgrade to 25.2.7 or newer
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.
Artifacts
Maven coordinates Vulnerable versions Fixed version
com.vaadin:vaadin 23.0.0 - 23.6.13 >=23.6.14
com.vaadin:vaadin 24.0.0 - 24.9.20 >=24.9.21
com.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10
com.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12
com.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7
com.vaadin:vaadin-core 24.7.0 - 24.9.20 >=24.9.21
com.vaadin:vaadin-core 24.10.0 - 24.10.9 >=24.10.10
com.vaadin:vaadin-core 25.0.0 - 25.1.11 >=25.1.12
com.vaadin:vaadin-core 25.2.0 - 25.2.6 >=25.2.7
com.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 >=23.6.14
com.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 >=24.9.21
com.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 >=24.10.10
com.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 >=25.1.12
com.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 >=25.2.7
npm packages
npm package Vulnerable versions Fixed version
@vaadin/charts 23.0.0 - 23.6.4 >=23.6.5
@vaadin/charts 24.0.0 - 24.9.17 >=24.9.18
@vaadin/charts 24.10.0 - 24.10.4 >=24.10.5
@vaadin/charts 25.0.0 - 25.1.11 >=25.1.12
@vaadin/charts 25.2.0 - 25.2.8 >=25.2.9
@vaadin/component-base 24.7.0 - 24.9.17 >=24.9.18
@vaadin/component-base 24.10.0 - 24.10.4 >=24.10.5
@vaadin/component-base 25.0.0 - 25.1.11 >=25.1.12
@vaadin/component-base 25.2.0 - 25.2.8 >=25.2.9
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 14:26 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
7 references
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| vaadin | vaadin |
Affected:
23.0.0 , < 23.6.14
(maven)
Affected: 24.0.0 , < 24.9.21 (maven) Affected: 24.10.0 , < 24.10.10 (maven) Affected: 25.0.0 , < 25.1.12 (maven) Affected: 25.2.0 , < 25.2.7 (maven) |
|
| vaadin | vaadin-core |
Affected:
24.7.0 , < 24.9.21
(maven)
Affected: 24.10.0 , < 24.10.10 (maven) Affected: 25.0.0 , < 25.1.12 (maven) Affected: 25.2.0 , < 25.2.7 (maven) |
|
| vaadin | vaadin-charts-flow |
Affected:
23.0.0 , < 23.6.14
(maven)
Affected: 24.0.0 , < 24.9.21 (maven) Affected: 24.10.0 , < 24.10.10 (maven) Affected: 25.0.0 , < 25.1.12 (maven) Affected: 25.2.0 , < 25.2.7 (maven) |
|
| vaadin | @vaadin/charts |
Affected:
23.0.0 , < 23.6.5
(semver)
Affected: 24.0.0 , < 24.9.18 (semver) Affected: 24.10.0 , < 24.10.5 (semver) Affected: 25.0.0 , < 25.1.12 (semver) Affected: 25.2.0 , < 25.2.9 (semver) |
|
| vaadin | @vaadin/component-base |
Affected:
24.7.0 , < 24.9.18
(semver)
Affected: 24.10.0 , < 24.10.5 (semver) Affected: 25.0.0 , < 25.1.12 (semver) Affected: 25.2.0 , < 25.2.9 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T14:26:16.234947Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T14:26:23.618Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "com.vaadin:vaadin",
"product": "vaadin",
"repo": "https://github.com/vaadin/platform",
"vendor": "vaadin",
"versions": [
{
"lessThan": "23.6.14",
"status": "affected",
"version": "23.0.0",
"versionType": "maven"
},
{
"lessThan": "24.9.21",
"status": "affected",
"version": "24.0.0",
"versionType": "maven"
},
{
"lessThan": "24.10.10",
"status": "affected",
"version": "24.10.0",
"versionType": "maven"
},
{
"lessThan": "25.1.12",
"status": "affected",
"version": "25.0.0",
"versionType": "maven"
},
{
"lessThan": "25.2.7",
"status": "affected",
"version": "25.2.0",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "com.vaadin:vaadin-core",
"product": "vaadin-core",
"repo": "https://github.com/vaadin/platform",
"vendor": "vaadin",
"versions": [
{
"lessThan": "24.9.21",
"status": "affected",
"version": "24.7.0",
"versionType": "maven"
},
{
"lessThan": "24.10.10",
"status": "affected",
"version": "24.10.0",
"versionType": "maven"
},
{
"lessThan": "25.1.12",
"status": "affected",
"version": "25.0.0",
"versionType": "maven"
},
{
"lessThan": "25.2.7",
"status": "affected",
"version": "25.2.0",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "com.vaadin:vaadin-charts-flow",
"product": "vaadin-charts-flow",
"repo": "https://github.com/vaadin/flow-components",
"vendor": "vaadin",
"versions": [
{
"lessThan": "23.6.14",
"status": "affected",
"version": "23.0.0",
"versionType": "maven"
},
{
"lessThan": "24.9.21",
"status": "affected",
"version": "24.0.0",
"versionType": "maven"
},
{
"lessThan": "24.10.10",
"status": "affected",
"version": "24.10.0",
"versionType": "maven"
},
{
"lessThan": "25.1.12",
"status": "affected",
"version": "25.0.0",
"versionType": "maven"
},
{
"lessThan": "25.2.7",
"status": "affected",
"version": "25.2.0",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://registry.npmjs.org",
"defaultStatus": "unaffected",
"packageName": "@vaadin/charts",
"product": "@vaadin/charts",
"repo": "https://github.com/vaadin/web-components",
"vendor": "vaadin",
"versions": [
{
"lessThan": "23.6.5",
"status": "affected",
"version": "23.0.0",
"versionType": "semver"
},
{
"lessThan": "24.9.18",
"status": "affected",
"version": "24.0.0",
"versionType": "semver"
},
{
"lessThan": "24.10.5",
"status": "affected",
"version": "24.10.0",
"versionType": "semver"
},
{
"lessThan": "25.1.12",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
},
{
"lessThan": "25.2.9",
"status": "affected",
"version": "25.2.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://registry.npmjs.org",
"defaultStatus": "unaffected",
"packageName": "@vaadin/component-base",
"product": "@vaadin/component-base",
"repo": "https://github.com/vaadin/web-components",
"vendor": "vaadin",
"versions": [
{
"lessThan": "24.9.18",
"status": "affected",
"version": "24.7.0",
"versionType": "semver"
},
{
"lessThan": "24.10.5",
"status": "affected",
"version": "24.10.0",
"versionType": "semver"
},
{
"lessThan": "25.1.12",
"status": "affected",
"version": "25.0.0",
"versionType": "semver"
},
{
"lessThan": "25.2.9",
"status": "affected",
"version": "25.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ridwan Arefin Islam, Madiba Security Lab, Concordia University"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgba(232, 232, 232, 0.04);\"\u003eA prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component\u0027s i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003eUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\u003cbr\u003e\u003cbr\u003eProduct version\u003cbr\u003eVaadin 23.0.0 - 23.6.13\u003cbr\u003eVaadin 24.0.0 - 24.9.20\u003cbr\u003eVaadin 24.10.0 - 24.10.9\u003cbr\u003eVaadin 25.0.0 - 25.1.11\u003cbr\u003eVaadin 25.2.0 - 25.2.6\u003cbr\u003e\u003cbr\u003eMitigation\u003cbr\u003eUpgrade to 23.6.14\u003cbr\u003eUpgrade to 24.9.21\u003cbr\u003eUpgrade to 24.10.10\u003cbr\u003eUpgrade to 25.1.12\u003cbr\u003eUpgrade to 25.2.7 or newer\u003cbr\u003e\u003cbr\u003ePlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.\u003cbr\u003e\u003cbr\u003eArtifacts\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eMaven coordinates\u003c/td\u003e\u003ctd\u003eVulnerable versions\u003c/td\u003e\u003ctd\u003eFixed version\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e23.0.0 - 23.6.13\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;23.6.14\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.0.0 - 24.9.20\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.9.21\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.10.0 - 24.10.9\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.10.10\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.0.0 - 25.1.11\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.1.12\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.2.0 - 25.2.6\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.2.7\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-core\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.7.0 - 24.9.20\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.9.21\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-core\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.10.0 - 24.10.9\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.10.10\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-core\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.0.0 - 25.1.11\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.1.12\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-core\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.2.0 - 25.2.6\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.2.7\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-charts-flow\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e23.0.0 - 23.6.13\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;23.6.14\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-charts-flow\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.0.0 - 24.9.20\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.9.21\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-charts-flow\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.10.0 - 24.10.9\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.10.10\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-charts-flow\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.0.0 - 25.1.11\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.1.12\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-charts-flow\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.2.0 - 25.2.6\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.2.7\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cbr\u003e\u003cbr\u003enpm packages\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003enpm package\u003c/td\u003e\u003ctd\u003eVulnerable versions\u003c/td\u003e\u003ctd\u003eFixed version\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/charts\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e23.0.0 - 23.6.4\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;23.6.5\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/charts\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.0.0 - 24.9.17\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.9.18\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/charts\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.10.0 - 24.10.4\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.10.5\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/charts\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.0.0 - 25.1.11\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.1.12\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/charts\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.2.0 - 25.2.8\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.2.9\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/component-base\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.7.0 - 24.9.17\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.9.18\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/component-base\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e24.10.0 - 24.10.4\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;24.10.5\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/component-base\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.0.0 - 25.1.11\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.1.12\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e@vaadin/component-base\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e25.2.0 - 25.2.8\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;25.2.9\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cbr\u003e\u003c/span\u003e"
}
],
"value": "A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component\u0027s i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 23.0.0 - 23.6.13\nVaadin 24.0.0 - 24.9.20\nVaadin 24.10.0 - 24.10.9\nVaadin 25.0.0 - 25.1.11\nVaadin 25.2.0 - 25.2.6\n\nMitigation\nUpgrade to 23.6.14\nUpgrade to 24.9.21\nUpgrade to 24.10.10\nUpgrade to 25.1.12\nUpgrade to 25.2.7 or newer\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version.\n\nArtifacts\nMaven coordinates Vulnerable versions Fixed version\ncom.vaadin:vaadin 23.0.0 - 23.6.13 \u003e=23.6.14\ncom.vaadin:vaadin 24.0.0 - 24.9.20 \u003e=24.9.21\ncom.vaadin:vaadin 24.10.0 - 24.10.9 \u003e=24.10.10\ncom.vaadin:vaadin 25.0.0 - 25.1.11 \u003e=25.1.12\ncom.vaadin:vaadin 25.2.0 - 25.2.6 \u003e=25.2.7\ncom.vaadin:vaadin-core 24.7.0 - 24.9.20 \u003e=24.9.21\ncom.vaadin:vaadin-core 24.10.0 - 24.10.9 \u003e=24.10.10\ncom.vaadin:vaadin-core 25.0.0 - 25.1.11 \u003e=25.1.12\ncom.vaadin:vaadin-core 25.2.0 - 25.2.6 \u003e=25.2.7\ncom.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 \u003e=23.6.14\ncom.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 \u003e=24.9.21\ncom.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 \u003e=24.10.10\ncom.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 \u003e=25.1.12\ncom.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 \u003e=25.2.7\n\nnpm packages\nnpm package Vulnerable versions Fixed version\n@vaadin/charts 23.0.0 - 23.6.4 \u003e=23.6.5\n@vaadin/charts 24.0.0 - 24.9.17 \u003e=24.9.18\n@vaadin/charts 24.10.0 - 24.10.4 \u003e=24.10.5\n@vaadin/charts 25.0.0 - 25.1.11 \u003e=25.1.12\n@vaadin/charts 25.2.0 - 25.2.8 \u003e=25.2.9\n@vaadin/component-base 24.7.0 - 24.9.17 \u003e=24.9.18\n@vaadin/component-base 24.10.0 - 24.10.4 \u003e=24.10.5\n@vaadin/component-base 25.0.0 - 25.1.11 \u003e=25.1.12\n@vaadin/component-base 25.2.0 - 25.2.8 \u003e=25.2.9"
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "AUTOMATIC",
"Safety": "NEGLIGIBLE",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "CLEAR",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T13:13:05.996Z",
"orgId": "9e0f3122-90e9-42d5-93de-8c6b98deef7e",
"shortName": "Vaadin"
},
"references": [
{
"url": "https://vaadin.com/security/cve-2026-91860"
},
{
"url": "https://github.com/vaadin/web-components/pull/12483"
},
{
"url": "https://github.com/vaadin/web-components/pull/12492"
},
{
"url": "https://github.com/vaadin/web-components/pull/12493"
},
{
"url": "https://github.com/vaadin/web-components/pull/12494"
},
{
"url": "https://github.com/vaadin/web-components/pull/12496"
},
{
"url": "https://github.com/vaadin/web-components/pull/12559"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cb\u003e\u003cspan style=\"background-color: transparent;\"\u003eUsers of affected versions should apply the following mitigation or upgrade.\u003c/span\u003e\u003c/b\u003e\u003cbr\u003e"
}
],
"value": "Users of affected versions should apply the following mitigation or upgrade."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9e0f3122-90e9-42d5-93de-8c6b98deef7e",
"assignerShortName": "Vaadin",
"cveId": "CVE-2026-91860",
"datePublished": "2026-09-30T13:13:05.996Z",
"dateReserved": "2026-09-15T09:33:38.900Z",
"dateUpdated": "2026-09-30T14:26:23.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90771 (GCVE-0-2026-90771)
Vulnerability from cvelistv5 – Published: 2026-09-13 10:45 – Updated: 2026-09-24 14:21
VLAI
EPSS
VEX
Title
joi before 17.13.8 and 18.2.9 Prototype Pollution via messages
Summary
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:02 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/issues/3150 | issue-tracking |
| https://github.com/hapijs/joi | product |
| https://github.com/hapijs/joi/blob/v18.2.8/lib/me… | technical-description |
| https://github.com/hapijs/joi/commit/5b8333c9177e… | patch |
| https://www.vulncheck.com/advisories/joi-before-1… | third-party-advisory |
Impacted products
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90771",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:02:28.580545Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:03:23.974Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/hapijs/joi/issues/3150"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/joi",
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"lessThan": "17.13.8",
"status": "affected",
"version": "16.0.0",
"versionType": "semver"
},
{
"lessThan": "18.2.9",
"status": "affected",
"version": "18.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object\u0027s prototype, breaking downstream code relying on Object.prototype methods."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:21:52.339Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #3150",
"tags": [
"issue-tracking"
],
"url": "https://github.com/hapijs/joi/issues/3150"
},
{
"tags": [
"product"
],
"url": "https://github.com/hapijs/joi"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js"
},
{
"tags": [
"patch"
],
"url": "https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb"
},
{
"name": "VulnCheck Advisory: joi before 17.13.8 and 18.2.9 Prototype Pollution via messages",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages"
}
],
"title": "joi before 17.13.8 and 18.2.9 Prototype Pollution via messages",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-90771",
"datePublished": "2026-09-13T10:45:42.498Z",
"dateReserved": "2026-09-13T10:14:57.680Z",
"dateUpdated": "2026-09-24T14:21:52.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89011 (GCVE-0-2026-89011)
Vulnerability from cvelistv5 – Published: 2026-09-10 19:56 – Updated: 2026-09-11 20:32 X_Open Source
VLAI
EPSS
VEX
Title
isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo
Summary
isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref negotiation. Attackers controlling a Git server can advertise a specially crafted ref such as '__proto__/corsProxy' to reroute all subsequent network operations through an attacker-controlled proxy, causing isomorphic-git to invoke the victim's onAuth callback and transmit credentials to the attacker when the victim calls getRemoteInfo with an attacker-supplied URL.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 17:09 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/isomorphic-git/isomorphic-git/… | vendor-advisory |
| https://github.com/isomorphic-git/isomorphic-git/… | release-notes |
| https://github.com/isomorphic-git/isomorphic-git/… | issue-tracking |
| https://github.com/isomorphic-git/isomorphic-git/… | patch |
| https://www.vulncheck.com/advisories/isomorphic-g… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| isomorphic-git | isomorphic-git |
Affected:
0 , < 1.42.0
(semver)
|
Date Public
2026-09-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89011",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T17:09:25.363378Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T20:32:36.479Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/isomorphic-git/isomorphic-git",
"product": "isomorphic-git",
"repo": "https://github.com/isomorphic-git/isomorphic-git",
"vendor": "isomorphic-git",
"versions": [
{
"lessThan": "1.42.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Isabel Mill"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulnCheck"
}
],
"datePublic": "2026-09-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing \u0027__proto__\u0027 path segments during ref negotiation. Attackers controlling a Git server can advertise a specially crafted ref such as \u0027__proto__/corsProxy\u0027 to reroute all subsequent network operations through an attacker-controlled proxy, causing isomorphic-git to invoke the victim\u0027s onAuth callback and transmit credentials to the attacker when the victim calls getRemoteInfo with an attacker-supplied URL."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T19:56:25.335Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-83vg-jxvh-fx76)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-83vg-jxvh-fx76"
},
{
"name": "Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.42.0"
},
{
"name": "Pull Request",
"tags": [
"issue-tracking"
],
"url": "https://github.com/isomorphic-git/isomorphic-git/pull/2426"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/isomorphic-git/isomorphic-git/commit/b3db111885230bac9a648e0a2312c65ca66f76eb"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/isomorphic-git-prototype-pollution-via-getremoteinfo"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "isomorphic-git \u003c 1.42.0 Prototype Pollution via getRemoteInfo",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-89011",
"datePublished": "2026-09-10T19:56:25.335Z",
"dateReserved": "2026-09-10T16:23:54.470Z",
"dateUpdated": "2026-09-11T20:32:36.479Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86536 (GCVE-0-2026-86536)
Vulnerability from cvelistv5 – Published: 2026-10-02 11:40 – Updated: 2026-10-02 17:31
VLAI
EPSS
VEX
Title
Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript
Summary
Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-02 17:31 UTC
CWE
- CWE-1321 - Improperly controlled modification of object prototype attributes ('prototype pollution')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/33otcgbqd27wf6qq8… | vendor-advisory |
| https://lists.apache.org/thread/xckvfky30kdnk8vqn… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Thrift |
Affected:
0 , < 0.25.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86536",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-02T17:31:18.825512Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T17:31:43.876Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://registry.npmjs.org",
"defaultStatus": "unaffected",
"packageName": "thrift",
"packageURL": "pkg:npm/thrift",
"product": "Apache Thrift",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.25.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "javascript bindings",
"product": "Apache Thrift",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.25.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "typescript bindings",
"product": "Apache Thrift",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.25.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Thrift."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027) vulnerability in Apache Thrift all JS bindings.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Thrift: before 0.25.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027) vulnerability in Apache Thrift all JS bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0 and re-generate JS code, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T11:40:06.911Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/xckvfky30kdnk8vqnhy0wndthvc9nymp"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object\u0027s prototype in generated JavaScript",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-86536",
"datePublished": "2026-10-02T11:40:06.911Z",
"dateReserved": "2026-09-07T22:00:32.242Z",
"dateUpdated": "2026-10-02T17:31:43.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86535 (GCVE-0-2026-86535)
Vulnerability from cvelistv5 – Published: 2026-10-02 11:38 – Updated: 2026-10-02 17:31
VLAI
EPSS
VEX
Title
Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely
Summary
Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-02 17:30 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/33otcgbqd27wf6qq8… | vendor-advisory |
| https://lists.apache.org/thread/94cvvzzl0rh707bn2… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Thrift |
Affected:
0 , < 0.25.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86535",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-02T17:30:50.294328Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T17:31:02.660Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://registry.npmjs.org",
"defaultStatus": "unaffected",
"packageName": "thrift",
"packageURL": "pkg:npm/thrift",
"product": "Apache Thrift",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "0.25.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Thrift."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eLoop with unreachable exit condition (\u0027infinite loop\u0027), Improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027) vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Thrift: before 0.25.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.25.0, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Loop with unreachable exit condition (\u0027infinite loop\u0027), Improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027) vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with unreachable exit condition (\u0027infinite loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly controlled modification of object prototype attributes (\u0027prototype pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T11:38:16.628Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/94cvvzzl0rh707bn2j4zt844v547508g"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache Thrift: A JSON member name can stall the Node server\u0027s event loop indefinitely",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-86535",
"datePublished": "2026-10-02T11:38:16.628Z",
"dateReserved": "2026-09-07T21:54:34.055Z",
"dateUpdated": "2026-10-02T17:31:02.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86078 (GCVE-0-2026-86078)
Vulnerability from cvelistv5 – Published: 2026-09-08 21:27 – Updated: 2026-09-09 16:03
VLAI
EPSS
VEX
Title
n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
Summary
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain __proto__ or constructor, causing nested writes to reach Object.prototype in the main n8n process and disrupt later requests. The affected function is summarizeWorkflowStructure in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts. This issue is fixed in versions 2.37.7 and 2.38.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:49 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/n8n-io/n8n/security/advisories… | x_refsource_CONFIRM |
| https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 | x_refsource_MISC |
| https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86078",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:49:54.950085Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:03:58.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"status": "affected",
"version": "\u003c 2.37.7"
},
{
"status": "affected",
"version": "\u003e= 2.38.0, \u003c 2.38.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain __proto__ or constructor, causing nested writes to reach Object.prototype in the main n8n process and disrupt later requests. The affected function is summarizeWorkflowStructure in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts. This issue is fixed in versions 2.37.7 and 2.38.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T21:27:21.351Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/n8n-io/n8n/security/advisories/GHSA-679f-58pq-4v2c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-679f-58pq-4v2c"
},
{
"name": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7"
},
{
"name": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2"
}
],
"source": {
"advisory": "GHSA-679f-58pq-4v2c",
"discovery": "UNKNOWN"
},
"title": "n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86078",
"datePublished": "2026-09-08T21:27:21.351Z",
"dateReserved": "2026-09-04T19:34:03.100Z",
"dateUpdated": "2026-09-09T16:03:58.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85625 (GCVE-0-2026-85625)
Vulnerability from cvelistv5 – Published: 2026-09-04 14:32 – Updated: 2026-09-14 19:33
VLAI
EPSS
VEX
Title
sift 17.1.3 Prototype Pollution Remote Code Execution via $where
Summary
sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:20 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/crcn/sift.js/issues/276 | issue-tracking |
| https://github.com/crcn/sift.js | product |
| https://github.com/crcn/sift.js/blob/v17.1.3/src/… | technical-description |
| https://www.vulncheck.com/advisories/sift-17.1.3-… | third-party-advisory |
Date Public
2026-07-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85625",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:20:21.665008Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:33:09.188Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/sift",
"product": "sift.js",
"vendor": "crcn",
"versions": [
{
"lessThanOrEqual": "17.1.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T14:32:15.388Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #276",
"tags": [
"issue-tracking"
],
"url": "https://github.com/crcn/sift.js/issues/276"
},
{
"tags": [
"product"
],
"url": "https://github.com/crcn/sift.js"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/crcn/sift.js/blob/v17.1.3/src/core.ts"
},
{
"name": "VulnCheck Advisory: sift 17.1.3 Prototype Pollution Remote Code Execution via $where",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sift-17.1.3-prototype-pollution-remote-code-execution-via-where"
}
],
"title": "sift 17.1.3 Prototype Pollution Remote Code Execution via $where",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85625",
"datePublished": "2026-09-04T14:32:15.388Z",
"dateReserved": "2026-09-04T11:03:33.316Z",
"dateUpdated": "2026-09-14T19:33:09.188Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
Architecture and Design
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Implementation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
Implementation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Implementation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.