CVE-2025-55182-Proof-of-Concept

CVE-2025-55182 Proof-of-Concept This repository contains a Proof-of-Concept PoC for CVE-2025-55182 , a vulnerability involving Prototype Pollution leading to Remote Code Execution RCE in certain server‑side rendering implementations. ⚠️ Warning: This PoC is strictly for educational, research, and...

CVE-2026-3030-Prototype-Pollution-in-JSON-Merge-Patch

CVE-2026-3030 – Prototype Pollution in JSON Merge Patch Program Code Node.js // server.js - Vulnerable REST API with deep merge const express = require'express'; const app = express; app.useexpress.json; let config = role: 'user', settings: ; // Insecure deep merge function pollutable via proto...

SealSecurity_Exam

SealSecurityExam Prototype pollution is a JavaScript vulnerability that enables an attacker to add arbitrary properties to global object prototypes, which may then be inherited by user-defined objects. A prototype pollution source is any user-controllable input that enables you to add arbitrary...

CVE-2025-55182-PoC

⚡ React2Shell Exploit PoC CVE-2025-66478 Next.js Remote Code Execution RCE via Prototype Pollution in Server Components 🕵️‍♂️ Overview This repository contains a Proof of Concept PoC for CVE-2025-66478 also referenced as CVE-2025-55182 in some contexts, a critical vulnerability affecting Next.js...

CVE-2026-110848: Improperly Controlled Modification of Object Prototype Attributes

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named proto throu...

CVE-2021-48012 fast-toml through 0.5.4 Prototype Pollution via __proto__ Keys in Parsed TOML

fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing proto, constructor or prototype key segments. Attackers can pass proto or constructor.prototype table headers or proto.x dotted keys to parse to pollu...

AZL-106857 CVE-2026-107301 affecting package msgpack 3.3.0-1

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a proto key can then replace the decoded object's prototype, potentiall...

CVE-2026-107301: Improperly Controlled Modification of Object Prototype Attributes

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a proto key can then replace the decoded object's prototype, potentiall...

Security Bulletin:Prototype Pollution Vulnerability in js-yaml Before 4.1.1 and 3.14.2

Summary js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is...

CVE-2026-106448

The @stablelib/cbor component within the StableLib library is vulnerable to prototype poisoning (CWE-1321) in versions prior to 2.0.4 . The root cause lies in the CBOR map decoding path, where the library creates ordinary JavaScript objects and uses bracket assignment for attacker-controlled keys...

CVE-2026-106448 StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named proto invokes the inherited prototype setter instead...

EUVD-2026-93973

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named proto invokes the inherited prototype setter instead...

CVE-2026-106448 StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named proto invokes the inherited prototype setter instead...

CVE-2026-106448 StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named proto invokes the inherited prototype setter instead...

EUVD-2026-91057

stream-json has a prototype pollution issue: Assembler writes this.currentthis.key on plain objects...

GHSA-MJW6-4JJ6-33HC stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects

Summary A prototype-pollution vulnerability in stream-json lets attacker-controlled JSON replace a parsed object's prototype. Details The streaming JSON parser StreamValues/StreamObject/jsonc variants writes keys via plain assignment, so a proto key replaces the parsed object's prototype with...

EUVD-2026-81604

vm2: Sandbox Escape NodeVM...

GHSA-X8MW-P69M-V3MX @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

Impact Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named proto or constructor resolves to an inherited value that is not an array, and the parse...

@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

Impact Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named proto or constructor resolves to an inherited value that is not an array, and the parse...

PT-2026-104427

Name of the Vulnerable Software and Affected Versions oRPC versions prior to 1.14.9 Description The @orpc/json-schema SmartCoercionPlugin utilizes JsonSchemaCoercer to collect object properties in a plain object and resolve schema.properties entries via the prototype chain. A remote client...