CVE-2026-3030-Prototype-Pollution-in-JSON-Merge-Patch

CVE-2026-3030 – Prototype Pollution in JSON Merge Patch Program Code Node.js root@kitploit: // server.js - Vulnerable REST API with deep merge const express = require'express'; const app = express; app.useexpress.json; let config = role: 'user', settings: ; // Insecure deep merge function...

DEBIAN-CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063

A flaw was found in node-csv, specifically within its csv-parse component. When configured with columns and groupcolumnsbyname options, a remote attacker can craft a malicious CSV header to manipulate the proto property. This allows the injection of attacker-controlled values into the parsed...

Prototype Pollution

Overview @tiptap/core is a headless rich text editor Affected versions of this package are vulnerable to Prototype Pollution via the mergeAttributes function. An attacker can inject malicious prototype properties by supplying crafted objects with a proto key, which can result in inherited...

Prototype Pollution

Elysia is vulnerable to Prototype Pollution. The vulnerability is due to improper deep-merge handling in the mergeDeep function when merging schema validation results, which allows an attacker to inject a proto property and, when chained with another flaw, achieve remote code execution...

Prototype Pollution

Overview org.webjars.npm:js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Prototype Pollution via the merge function. An attacker can alter object prototypes by supplying specially crafted YAML documents containing proto properties. This...

Prototype Pollution

Overview org.webjars.bower:linkifyjs is a Find URLs, email addresses, hashtags and @mentions in plain-text strings, then convert them into HTML links. Affected versions of this package are vulnerable to Prototype Pollution via the internal assign helper due to improper filtering of the proto...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution through the function s.contexts..configure function. An attacker can execute arbitrary code or cause a denial of service by injecting arbitrary properties into the object prototype. PoC js async = const lib = await...

Prototype Pollution

Overview lutils is an A few reliable utils. Affected versions of this package are vulnerable to Prototype Pollution via the main merge function. PoC const lt = require'lutils'; let obj = ; console.log"Before being polluted: " + obj.polluted; var EVILJSON = JSON.parse'"proto":"polluted":true';...

Prototype Pollution

Overview properties-reader is a Properties file reader for Node.js Affected versions of this package are vulnerable to Prototype Pollution. PoC by Eugene Lim: payload.properties proto polluted = polluted poc.js: var propertiesReader = require'properties-reader';...