{"schema":"threatline.record/2","record":{"id":"CVE-2026-33228","aliases":["GHSA-rf6f-7fwh-wjgh"],"summary":"Prototype Pollution via parse() in NodeJS flatted","details":"---\n  **Summary**\n\n  The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index\n  keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it\n  with the key \"\\_\\_proto\\_\\_\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate\n   parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype\n   to the consumer. Any code that subsequently writes to that property will pollute the global prototype.\n\n  ---\n  **Root Cause**\n\n  File: esm/index.js:29 (identical in cjs/index.js)\n```\n  const resolver = (input, lazy, parsed, $) => output => {\n    for (let ke = keys(output), {length} = ke, y = 0; y < length; y++) {\n      const k = ke[y];\n      const value = output[k];    \n      if (value instanceof Primitive) {\n        const tmp = input[value];      // Bug is here\n```\n\nNo validation that value is a safe numeric index input is built as a plain Array. JavaScript's property lookup on arrays traverses the prototype chain for non-numeric  keys. The key \"\\_\\_proto\\_\\_\" resolves to Array.prototype, which:\n\n  - has type \"object\" → passes the typeof tmp === object guard at line 30\n  - is not in the parsed Set yet → passes the !parsed.has(tmp) guard.\n  - The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.\n  ---\n  **Replication Steps**\n```\n  const Flatted = require('flatted'); \n  const parsed = Flatted.parse('[{\"x\":\"__proto__\"}]');\n  parsed.x.polluted = 'pwned';\n  console.log([].polluted);  // Returns true\n``` \n ---\n  **Impact**\n An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.\n\n  **Recommended solution**\n Validate that the index string represents an integer within the bounds of input before accessing it:\n\n  // Before (vulnerable)\n  const tmp = input[value];\n\n  // After (safe)\n  const idx = +value;  // coerce boxed String → number\n  const tmp = (Number.isInteger(idx) && idx >= 0 && idx < input.length)\n    ? input[idx]\n    : undefined;","categories":["Libraries & packages"],"product":"flatted","vendor":"WebReflection","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","source_modified_at":"2026-10-05T15:48:47Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"flatted"},"range":"<= 3.4.1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-33228","source_modified_at":"2026-09-07T12:05:12.907Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"flatted","vendor":"WebReflection","versions":[{"version":"< 3.4.2","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-rf6f-7fwh-wjgh","source_modified_at":"2026-10-05T16:00:04.586755982Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"flatted","purl":"pkg:npm/flatted"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"3.4.2"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","source_modified_at":"2026-10-05T15:48:47Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"flatted"},"version":"3.4.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-rf6f-7fwh-wjgh","source_modified_at":"2026-10-05T16:00:04.586755982Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"flatted","purl":"pkg:npm/flatted"},"version":"3.4.2"}],"cvss":8.9,"severity":"High","kev":{"listed":false},"epss":{"probability":0.01282,"percentile":0.69859,"score_date":"2026-10-23"},"published_at":"2026-03-20T23:06:48.485Z","modified_at":"2026-10-05T16:00:04.586755982Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-05T15:48:47Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-33228","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-07T12:05:12.907Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-rf6f-7fwh-wjgh","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-05T16:00:04.586755982Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-33228","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/WebReflection/flatted/security/advisories/GHSA-rf6f-7fwh-wjgh","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33228","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/WebReflection/flatted/releases/tag/v3.4.2","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:13826","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:34342","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:9742","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/security/cve/CVE-2026-33228","tags":["vdb-entry","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449872","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33228.json","tags":["x_sadp-csaf-vex"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"total","assessed_at":"2026-03-24T17:35:34.197834Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-05T16:00:04.586755982Z","content_hash":"00aff3e4b73cdce85ccd87008cc8cb656078422543c1e954bbeb3750cc1c1704"}}