GHSA-XCG2-9PP4-J82X rollbar vulnerable to Prototype Pollution in merge()

Impact Prototype pollution vulnerability in merge. If application code calls rollbar.configure with untrusted input, prototype pollution is possible. Patches Fixed in 2.26.5 and 3.0.0-beta5. Workarounds Ensure that values passed to rollbar.configure do not contain untrusted input. References Fixe...

Prototype Pollution

Overview rollbar is an Effortlessly track and debug errors in your JavaScript applications with Rollbar. This package includes advanced error tracking features and an intuitive interface to help you identify and fix issues more quickly. Affected versions of this package are vulnerable to Prototyp...

CVE-2025-62517

Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prototype pollution vulnerability in merge. If application code calls rollbar.configure with untrusted input, prototype pollution is possible...

CVE-2025-62517 Rollbar.js Prototype Pollution Vulnerability in merge()

Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prototype pollution vulnerability in merge. If application code calls rollbar.configure with untrusted input, prototype pollution is possible...

CVE-2025-62517 Rollbar.js Prototype Pollution Vulnerability in merge()

Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prototype pollution vulnerability in merge. If application code calls rollbar.configure with untrusted input, prototype pollution is possible...

CVE-2025-62517

CVE-2025-62517 affects Rollbar.js. A prototype pollution vulnerability exists in the merge() function when application code calls rollbar.configure() with untrusted input. This could enable prototype pollution under vulnerable versions (pre-2.26.5 and 3.0.0-alpha1 to before 3.0.0-beta5). The issu...

Rollbar.js 安全漏洞

Rollbar.js is a bug tracking and logging library from Rollbar open source. A security vulnerability exists in Rollbar.js versions prior to 2.26.5 and versions prior to 3.0.0-alpha1 through 3.0.0-beta5, which stems from a prototype contamination in the merge function that could lead to malicious...

PT-2025-43560

Name of the Vulnerable Software and Affected Versions Rollbar.js versions prior to 2.26.5 Rollbar.js versions 3.0.0-alpha1 through 3.0.0-beta5 Description Rollbar.js provides error tracking and logging from Javascript to Rollbar. A prototype pollution issue exists in the merge function when...

EUVD-2021-1256

Malware in sbrugna...

EUVD-2021-2452

Malware in sbrugna...

EUVD-2019-0737

Malware in sbrugna...

EUVD-2021-2399

Malware in sbrugna...

EUVD-2021-1982

Malware in sbrugna...

EUVD-2022-0813

Malicious code in bioql PyPI...

CVE-2025-3193

Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the merge function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edge-case" that the resulting error is...

GHSA-529Q-4J3P-7C5R algoliasearch-helper is vulnerable to Prototype Pollution in _merge()

Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the merge function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edge-case" that the resulting error is...

CVE-2025-3193

Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the merge function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edge-case" that the resulting error is...

CVE-2025-3193

Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the merge function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edge-case" that the resulting error is...

CVE-2025-3193

Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the merge function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edge-case" that the resulting error is...

CVE-2025-3193

The CVE-2025-3193 entry concerns algoliasearch-helper versions 2.0.0-rc1 through 3.11.2 (and earlier) with a Prototype Pollution in the _merge() function of merge.js. The underlying issue allows modification of constructor.prototype and, in an extreme edge-case where the resulting error is caught...