CVE-2026-104183 stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...

CVE-2026-104183

The stream-json micro-library (versions prior to 3.6.0 ) is vulnerable to a prototype pollution flaw within its Assembler component. The root cause is the use of plain assignment to materialize object properties, which allows an input key named __proto__ to invoke an inherited setter. This result...

Reliance on Untrusted Inputs in a Security Decision

Overview org.webjars.npm:katex is a Fast math typesetting for the web. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the applySetting function in src/Settings.ts and the get/set methods in src/Namespace.ts, where user-controlled option...

Reliance on Untrusted Inputs in a Security Decision

Overview katex is a Fast math typesetting for the web. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the applySetting function in src/Settings.ts and the get/set methods in src/Namespace.ts, where user-controlled option keys and macro...

CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

DEBIAN-CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

UBUNTU-CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CVE-2026-103923

The KaTeX JavaScript library (versions 0.11.0 through 0.18.2 ) is vulnerable to a flaw where it uses ordinary JavaScript property access for various configuration objects, such as renderer options and trust settings. This allows inherited properties to be treated as explicitly supplied values. If...

CVE-2026-103923 KaTeX: Existing prototype pollution can bypass trust restrictions

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CVE-2026-103923 KaTeX: Existing prototype pollution can bypass trust restrictions

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CVE-2026-103923 KaTeX: Existing prototype pollution can bypass trust restrictions

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion

This is another instance of https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4, where some payloads could cause parse to create objects with a proto own property. This on its own is not enough to cause prototype pollution, and indeed this is actually how JSON.parse works,...

Prototype Pollution

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Prototype Pollution via the unflatten function in src/parse.js, where object keys parsed from untrust...

NPM: piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

NPM: piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env vulnerability discovered by ? in WordPress Npm piscina versions 4.9.4...

EUVD-2026-90364

piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env...

GHSA-67C8-PQHQ-4RMX piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

Summary A prototype-pollution gadget in ThreadPool.options allows an attacker who can pollute Object.prototype to execute arbitrary code in Piscina worker threads, invoke arbitrary functions during task scheduling, or inject environment variables into workers. The root cause is that...

piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

Summary A prototype-pollution gadget in ThreadPool.options allows an attacker who can pollute Object.prototype to execute arbitrary code in Piscina worker threads, invoke arbitrary functions during task scheduling, or inject environment variables into workers. The root cause is that...

Prototype Pollution

Overview piscina is an A fast, efficient Node.js Worker Thread Pool implementation Affected versions of this package are vulnerable to Prototype Pollution via user-controlled options objects in the ThreadPool constructor and the run/close methods. When an attacker can pollute Object.prototype, th...