https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 17:41:32 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-110816 <p>### Summary</p> <p>`qs.stringify` with `arrayFormat: &#39;comma&#39;` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ &#34;toString&#34;: &#34;x&#34; }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.</p> <p>### Details</p> <p>In `lib/stringify.js`, the comma branch collapses the array with `obj.join(&#39;,&#39;)`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ &#34;a&#34;: [[{ &#34;toString&#34;: &#34;x&#34; }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.</p> <p>Such elements can come from untrusted input. `JSON.parse` produces `{ &#34;a&#34;: [{ &#34;toString&#34;: &#34;x&#34; }] }` with no qs option involved. `qs.parse(&#34;a[0][toString]=x&#34;, { allowPrototypes: true })` keeps the `toString` key, and `qs.parse(&#34;a[][b]=c&#34;, { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary object…</p> <p>### Summary</p> <p>`qs.stringify` with `arrayFormat: &#39;comma&#39;` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ &#34;toString&#34;: &#34;x&#34; }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.</p> <p>### Details</p> <p>In `lib/stringify.js`, the comma branch collapses the array with `obj.join(&#39;,&#39;)`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ &#34;a&#34;: [[{ &#34;toString&#34;: &#34;x&#34; }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.</p> <p>Such elements can come from untrusted input. `JSON.parse` produces `{ &#34;a&#34;: [{ &#34;toString&#34;: &#34;x&#34; }] }` with no qs option involved. `qs.parse(&#34;a[0][toString]=x&#34;, { allowPrototypes: true })` keeps the `toString` key, and `qs.parse(&#34;a[][b]=c&#34;, { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary object…</p> https://db.gcve.eu/vuln/fkie_cve-2026-110816