Prototype Pollution

Overview protobufjs is a protocol buffer for JavaScript & TypeScript. Affected versions of this package are vulnerable to Prototype Pollution through the textformat file. An attacker can modify the prototype of the returned map object by supplying a specially crafted map entry with the key proto...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @20206205tech/nestjs-common (>=0.8.0, <=0.11.3) +1151 more potentially affected by CVE-2026-59877 via protobufjs (>=8.0.0, <=8.6.5)

protobufjs NPM version =8.0.0, =1.1.0-beta.8, =0.8.0, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.8.0 and more Source cves: CVE-2026-59877 Source advisory: SNYK:JS-PROTOBUFJS-17900550...

@alessiodf/core-chameleon (0.0.1), @arkecosystem/core (>=3.0.0-alpha.0, <=3.13.0) +143 more potentially affected by CVE-2026-59879 via immutable (>=5.0.0, <=5.1.6)

immutable NPM version =5.0.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.6, =3.9.0-rc.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =9.1.1-ruixiang.1, =0.1.0, =1.0.6 and more Source cves: CVE-2026-59879 Source advisory: SNYK:JS-IMMUTABLE-17900573...

@0xgraph/cli (>=0.0.1, <=0.2.1), @actra-development-oss/redux-persistable (>=2.0.0, <=3.0.0) +653 more potentially affected by CVE-2026-59880 via immutable (>=4.0.0, <=4.3.8)

immutable NPM version =4.0.0, =0.0.1, =2.0.0, =0.2.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.0.1, =0.11.8-rc.0, =0.1.0, =0.3.3 - @alfresco/adf-testing 6.0.0-A.2-8258 - @alys-chain/graph-alys-cli 0.88.0 and more Source cves: CVE-2026-59880 Source advisory: SNYK:JS-IMMUTABLE-17900558...

@a1st/aix (>=0.0.3, <=0.6.0), @a1st/aix-core (>=0.2.0, <=0.6.0) +20 more potentially affected by CVE-2026-59731 via astro (>=6.0.0-beta.1, <=6.4.6)

astro NPM version =6.0.0-beta.1, =0.0.3, =0.2.0, =1.11.1, =2.7.0, =0.3.0, =0.22.0, =1.4.1, =0.19.0, =0.19.0, =1.10.0, =1.12.0 - astro-crush 1.0.0 and more Source cves: CVE-2026-59731 Source advisory: SNYK:JS-ASTRO-17901336...

@0xwork/connect (>=0.1.0, <=0.1.8), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +28 more potentially affected by CVE-2026-59261 via openclaw (>=2026.3.22, <=2026.5.27)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-59261 Source advisory: SNYK:JS-OPENCLAW-17905620...

@briefhq/cli (>=0.1.6, <=0.1.22), @cobuild/review-gpt (>=0.5.10, <=0.5.139) +5 more potentially affected by CVE-2026-59703 via repomix (>=1.1.0, <=1.16.0)

repomix NPM version =1.1.0, =0.1.6, =0.5.10, =0.1.0-next.1, =1.0.0, =0.1.0, =0.63.0, =0.63.3 Source cves: CVE-2026-59703 Source advisory: SNYK:JS-REPOMIX-17905425...

CVE-2026-59876

protobufjs compiles protobuf definitions into JavaScript JS functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key proto to change the prototype of the returned map object instead of...

CVE-2026-57439

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts proto as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript in...

EUVD-2026-42294

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts proto as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript in...

CVE-2026-57439

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts proto as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript in...

CVE-2026-57439 CyberChef: Prototype pollution in Series Chart operation

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts proto as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript in...

CVE-2026-57439

CyberChef’s CVE-2026-57439 affects the Series Chart operation prior to version 11.2.0. The vulnerability arises when parsing user-supplied CSV, where proto can be used as a key, enabling prototype pollution. This can be chained with other operations (e.g., Parse UDP) to inject malicious JavaScrip...

CVE-2026-57439 CyberChef: Prototype pollution in Series Chart operation

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts proto as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript in...

@bonjour-les-pixels/component-library (>=1.0.23, <=1.0.27), @bonjour_les_pixels/component-library (>=0.0.1, <=0.0.4) +5 more potentially affected by CVE-2026-15033 via check-peer-dependencies (>=1.0.2, <=4.3.4)

check-peer-dependencies NPM version =1.0.2, =1.0.23, =0.0.1, =0.0.0-2025.1-0, =2.3.35, =1.2.0, =1.3.1 - droneci-deck 1.0.0 Source cves: CVE-2026-15033 Source advisory: SNYK:JS-CHECKPEERDEPENDENCIES-17954519...

The vulnerability of the Lodash library lies in the uncontrolled modification of prototype attributes, which allows attackers to compromise the integrity and accessibility of the protected information.

The vulnerability of the Lodash library is related to uncontrolled changes to the attributes of the object’s prototype. Exploiting this vulnerability could allow an attacker, operating remotely, to compromise the integrity and accessibility of the protected information...

The vulnerability of the _.unset and _.omit functions in the Lodash library, which allows an attacker to compromise data integrity

The vulnerability of the unset and omit functions in the Lodash library is related to uncontrolled changes to prototype attributes of objects. Exploiting this vulnerability could allow a malicious actor to compromise data integrity...

Improper Check for Unusual or Exceptional Conditions

Overview org.webjars.npm:phoenix is a The official JavaScript client for the Phoenix web framework. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the syncState and syncDiff presence reconciliation code in assets/js/phoenix/presence.js...

PYSEC-2026-1308 docarray prototype pollution

A vulnerability was found in docarray up to 0.40.1. It has been rated as critical. Affected by this issue is the function getitem of the file /docarray/data/torchdataset.py of the component Web API. The manipulation leads to improperly controlled modification of object prototype attributes...

PYSEC-2026-1624 Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacks

From @jackfromeast and @superboy-zjc: We have identified a class pollution vulnerability in Mesop = 0.14.0 application that allows attackers to overwrite global variables and class attributes in certain Mesop modules during runtime. This vulnerability could directly lead to a denial of service Do...