CVE-2025-66456

Summary of the CVE-2025-66456 family (Elysia): Elysia (

CVE-2025-66456 Elysia vulnerable to prototype pollution with multiple standalone schema validation

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in mergeDeep after merging results of two standard schema validations with the same key. Due to...

CVE-2025-66456 Elysia vulnerable to prototype pollution with multiple standalone schema validation

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in mergeDeep after merging results of two standard schema validations with the same key. Due to...

CVE-2025-66456 Elysia vulnerable to prototype pollution with multiple standalone schema validation

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in mergeDeep after merging results of two standard schema validations with the same key. Due to...

elysia 安全漏洞

elysia is a framework of elysia open source. A security vulnerability exists in elysia versions 1.4.0 through 1.4.16, which stems from a prototype contamination in the mergeDeep function that could lead to remote code execution...

CVE-2024-38996

ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the .mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...

CVE-2024-38990

Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...

Prototype Pollution

ag-grid-community and ag-grid-enterprise are vulnerable to prototype pollution. The vulnerability is due to the .mergeDeep function, allowing attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...

Prototype Pollution

@abip/sp-common is vulnerable to Prototype Pollution. The vulnerability is due to the function mergeDeep, which allows attackers to inject arbitrary properties. The attacker can execute arbitrary code or cause a Denial of Service DoS as a result...

Prototype pollution in ag-grid-community via the _.mergeDeep function

ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the .mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties. Prior versions were also found ...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview org.webjars.npm:ag-charts-community is an Advanced Charting / Charts supporting Javascript / Typescript / React / Angular / Vue Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the .mergeDeep function. ...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview org.webjars.npm:ag-grid-enterprise is an Advanced Data Grid / Data Table supporting Javascript / Typescript / React / Angular / Vue Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the .mergeDeep...

CVE-2024-38996

ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the .mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...

PT-2024-28311 · Unknown · Ag-Grid-Community +1

Name of the Vulnerable Software and Affected Versions: ag-grid-community version 31.3.2 ag-grid-enterprise version 31.3.2 Description: The issue is related to a prototype pollution via the .mergeDeep function, allowing attackers to execute arbitrary code or cause a Denial of Service DoS by...

CVE-2024-38996

ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the .mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...

sp-common Security Vulnerabilities

sp-common is a library by Peter Personal Developer. A security vulnerability exists in sp-common version v0.5.4, which originates from the inclusion of prototype contamination via the function mergeDeep, allowing an attacker to execute arbitrary code or cause a denial of service DoS by injecting...

AG Grid Security Breach

AG Grid is a full-featured, highly customizable JavaScript data grid from AG Grid Open Source. A security vulnerability exists in AG Grid version v31.3.2, which stems from the inclusion of prototype contamination via the mergeDeep function, allowing an attacker to execute arbitrary code or cause ...

PT-2024-28306 · Tada5Hi · Sp-Common

Name of the Vulnerable Software and Affected Versions: Tada5hi sp-common version 0.5.4 Description: The issue allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties through a prototype pollution vulnerability in the mergeDeep function...

Prototype Pollution

web3-utils is vulnerable to Prototype Pollution. The vulnerability is due to insecure recursive merge via the utility functions format and mergeDeep, allowing an attacker to manipulate an object's prototype by passing specially crafted input to these functions...

web3-utils Prototype Pollution vulnerability

Impact: The mergeDeep function in the web3-utils package has been identified for Prototype Pollution vulnerability. An attacker has the ability to modify an object's prototype, which could result in changing the behavior of all objects that inherit from the impacted prototype by providing careful...