https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 18:46:46 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-368263 EUVD-2026-368263 https://cve.radiocsirt.org/vuln/euvd-2026-368263 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55091 <p>flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is __proto__, temp[parent] can resolve to Object.prototype, and initPush() can write attacker-controlled data to the global children prototype property while existing prototype methods remain intact. Any application that passes attacker-influenced flat records to convert() can therefore expose unrelated objects to polluted inherited state, causing application-logic corruption or denial of service and potentially enabling greater impact when a downstream prototype-pollution gadget is present. The constructor and prototype strings are also unsafe inherited-key values in the same lookup design. This issue is fixed in version 1.1.2.</p> <p>flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is __proto__, temp[parent] can resolve to Object.prototype, and initPush() can write attacker-controlled data to the global children prototype property while existing prototype methods remain intact. Any application that passes attacker-influenced flat records to convert() can therefore expose unrelated objects to polluted inherited state, causing application-logic corruption or denial of service and potentially enabling greater impact when a downstream prototype-pollution gadget is present. The constructor and prototype strings are also unsafe inherited-key values in the same lookup design. This issue is fixed in version 1.1.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55091 https://cve.radiocsirt.org/vuln/ghsa-hp36-v28f-w3r4 <p><strong>Affected:</strong> npm: flat-to-nested</p> <p>### Summary `convert()` builds the nested tree by using each flat record&#39;s `id` and `parent` field values directly as object keys, with no guard against `__proto__` / `constructor` / `prototype`. A record whose `parent` is the string `&#34;__proto__&#34;` makes `temp[parent]` resolve to `Object.prototype`, and the following `initPush(...)` writes attacker-controlled data onto the global prototype. Any application that passes attacker-influenced records to `convert()` is affected, and the base prototype methods stay intact so the pollution is stealthy.</p> <p>### Details In `index.js`, `convert()` (`FlatToNested.prototype.convert`):</p> <p>- `temp = {}` (line 45) and `pendingChildOf = {}` (line 46) are plain objects, so they inherit from `Object.prototype`. - For each record, `parent = flatEl[this.config.parent]` (line 51) is taken verbatim from input. - Line 57: `if (temp[parent] !== undefined)` — when `parent === &#34;__proto__&#34;`, `temp[&#34;__proto__&#34;]` resolves via the prototype chain to `Object.prototype`, which is `!== undefined`, so the branch is taken. - Line 59: `initPush(this.config.children, temp[parent], flatEl)` → effectively `initPush(&#34;children&#34;, Object.prototype, flatEl)`. - `initPush` (lines 4-9): `Object.prototype[&#34;children&#34;] = []` then `Object.prototype[&#34;children&#34;].push(flatEl)` — **attacker-controlled data is written onto the global `Object.prototype`.**</p> <p>There is no sanitization of `id` / `parent` anywhere; they flow straight into `temp[id]`, `temp[parent]`, and `…</p> <p><strong>Affected:</strong> npm: flat-to-nested</p> <p>### Summary `convert()` builds the nested tree by using each flat record&#39;s `id` and `parent` field values directly as object keys, with no guard against `__proto__` / `constructor` / `prototype`. A record whose `parent` is the string `&#34;__proto__&#34;` makes `temp[parent]` resolve to `Object.prototype`, and the following `initPush(...)` writes attacker-controlled data onto the global prototype. Any application that passes attacker-influenced records to `convert()` is affected, and the base prototype methods stay intact so the pollution is stealthy.</p> <p>### Details In `index.js`, `convert()` (`FlatToNested.prototype.convert`):</p> <p>- `temp = {}` (line 45) and `pendingChildOf = {}` (line 46) are plain objects, so they inherit from `Object.prototype`. - For each record, `parent = flatEl[this.config.parent]` (line 51) is taken verbatim from input. - Line 57: `if (temp[parent] !== undefined)` — when `parent === &#34;__proto__&#34;`, `temp[&#34;__proto__&#34;]` resolves via the prototype chain to `Object.prototype`, which is `!== undefined`, so the branch is taken. - Line 59: `initPush(this.config.children, temp[parent], flatEl)` → effectively `initPush(&#34;children&#34;, Object.prototype, flatEl)`. - `initPush` (lines 4-9): `Object.prototype[&#34;children&#34;] = []` then `Object.prototype[&#34;children&#34;].push(flatEl)` — **attacker-controlled data is written onto the global `Object.prototype`.**</p> <p>There is no sanitization of `id` / `parent` anywhere; they flow straight into `temp[id]`, `temp[parent]`, and `…</p> https://cve.radiocsirt.org/vuln/ghsa-hp36-v28f-w3r4