https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 23:20:32 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336454 EUVD-2026-336454 https://cve.radiocsirt.org/vuln/euvd-2026-336454 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56763 <p>Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.</p> <p>Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56763 https://cve.radiocsirt.org/vuln/ghsa-3wcj-gjvf-fvch <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> npm: hono</p> <p>## Duplicate Advisory</p> <p>This advisory has been withdrawn because it is a duplicate of GHSA-v8w9-8mx6-g223. This link is maintained to preserve external references.</p> <p>## Original Description</p> <p>Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> npm: hono</p> <p>## Duplicate Advisory</p> <p>This advisory has been withdrawn because it is a duplicate of GHSA-v8w9-8mx6-g223. This link is maintained to preserve external references.</p> <p>## Original Description</p> <p>Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ properties. When parsed results are merged into regular JavaScript objects using unsafe merge patterns, attackers can exploit this to achieve prototype pollution and modify object behavior.</p> https://cve.radiocsirt.org/vuln/ghsa-3wcj-gjvf-fvch