stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

Summary A prototype-pollution vulnerability in stream-json lets attacker-controlled JSON replace a parsed object's prototype. Details The streaming JSON parser StreamValues/StreamObject/jsonc variants writes keys via plain assignment, so a proto key replaces the parsed object's prototype with...

EUVD-2026-91057

stream-json has a prototype pollution issue: Assembler writes this.currentthis.key on plain objects...

GHSA-MJW6-4JJ6-33HC stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

Summary A prototype-pollution vulnerability in stream-json lets attacker-controlled JSON replace a parsed object's prototype. Details The streaming JSON parser StreamValues/StreamObject/jsonc variants writes keys via plain assignment, so a proto key replaces the parsed object's prototype with...

NPM: vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

NPM: vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.0, = 3.11.7...

vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

Summary vm2's current host-intrinsic prototype protection is incomplete. The fix for GHSA-vwrp-x96c-mhwq blocks sandbox writes into classic host intrinsics such as Object.prototype, Array.prototype, and Function.prototype, but current head still lets sandbox code in a default VM reach and mutate...

GHSA-3VGF-8M4Q-Q4QR vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

Summary vm2's current host-intrinsic prototype protection is incomplete. The fix for GHSA-vwrp-x96c-mhwq blocks sandbox writes into classic host intrinsics such as Object.prototype, Array.prototype, and Function.prototype, but current head still lets sandbox code in a default VM reach and mutate...

EUVD-2026-63829

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name...

CVE-2025-55182-React2Shell-Async-Scanner

⚡ React2Shell CVE-2025-55182 / CVE-2025-66478 - Async RCE Scanner Prototype-pollution → Remote Code Execution via React Server Actions Async, version-first, output-based canary detection - no blind guessing !WARNING For authorised security research and penetration testing only. Scanning systems...

EUVD-2026-91793

@orpc/zod: Prototype injection in smart coercion...

react2shell-poc

React2Shell - CVE-2025-55182 PoC Prueba de concepto para CVE-2025-55182 , una vulnerabilidad crítica de ejecución remota de código no autenticada en React Server Components. Puntuación CVSS: 10.0 Crítica Vulnerabilidad La vulnerabilidad se encuentra en el deserializador del protocolo Flight de...

Prototype Pollution

isomorphic-git is vulnerable to prototype pollution. The vulnerability is due to insufficient validation of ref names in the getRemoteInfo function, where a malicious Git server can advertise crafted ref names containing proto path segments e.g., proto/corsProxy that pollute Object.prototype, and...

ROOT-APP-NPM-CVE-2026-6733 CVE-2026-6733 in undici - Patched by Root

Root has patched CVE-2026-6733 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-11525 CVE-2026-11525 in undici - Patched by Root

Root has patched CVE-2026-11525 in the undici package for Root:npm. Multiple fixed versions available...

Astra Linux – Vulnerability in node-json5

JSON5 is an extension to the popular JSON file format, designed to make it easier to write and maintain manually, especially for configuration files. The parse method in the JSON5 library, as of versions 1.0.1 and 2.2.1, does not restrict the parsing of keys named proto. This allows specially...

Astra Linux – Vulnerability in Node.js

Due to the formatting logic of the "console.table" function, it is not safe to allow user-controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". This approach causes prototy...

Astra Linux – Vulnerability in node-minimist

Minimist =1.2.5 is vulnerable to Prototype Pollution through the file index.js, the function setKey lines 69-95...

Astra Linux – Vulnerability in Node-EJS

The ejs also known as Embedded JavaScript templates package in Node.js before version 3.1.10 lacked certain measures to prevent pollution...

Astra Linux – Vulnerability in node-getobject

A vulnerability in the “getobject” version 0.1.0 prototype allows an attacker to cause a denial of service and may lead to remote code execution...

react2shellexploitvisualized

Visualización de React2Shell CVE-2025-55182 Una visualización educativa interactiva que explica la vulnerabilidad React2Shell: un fallo crítico de ejecución remota de código con puntuación CVSS 10.0 en React Server Components. Qué es esto Un recorrido narrado de 5 pasos que explica: 1. SSR...

[SECURITY] [DLA 4820-1] node-lodash security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-4820-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta October 05, 2026 https://wiki.debian.org/LTS -...