{"schema":"threatline.record/2","record":{"id":"CVE-2026-97724","aliases":[],"summary":"A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object cr","details":"A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object created during serialization in clonePlainJSObject in packages/react-native-worklets/src/memory/serializable.native.ts. When affected data is subsequently processed by React Native Worklets, the malformed serialized object can cause the React Native application to crash. This can result in a remotely triggered denial of service in applications that pass attacker-controlled data through the affected serialization path. In applications where the attacker-controlled data is persisted, the denial of service may persist across application restarts or repeated attempts to access the affected content.","categories":["Frameworks"],"product":"React Native Reanimated","vendor":"swmansion","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97724","source_modified_at":"2026-09-25T13:55:20.329Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"React Native Reanimated","vendor":"swmansion","versions":[{"lessThan":"worklets-0.12.2","status":"affected","version":"worklets-0.5.0","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00253,"percentile":0.15835,"score_date":"2026-10-23"},"published_at":"2026-09-25T02:09:17.218Z","modified_at":"2026-09-25T13:55:20.329Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-97724","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-25T13:55:20.329Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97724","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/software-mansion/react-native-reanimated/issues/10436","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/software-mansion/react-native-reanimated/pull/10451"},{"source":"CVE List","url":"https://github.com/software-mansion/react-native-reanimated/pull/10462"},{"source":"CVE List","url":"https://github.com/software-mansion/react-native-reanimated/releases/tag/worklets-0.12.2"},{"source":"CVE List","url":"https://docs.swmansion.com/react-native-reanimated/"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-25T13:54:55.193703Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-25T13:55:20.329Z","content_hash":"05e22e019e3ef9a07fdec4bdf5aff5c0f2eb1a68b05ab5a98088fcc76d8534de"}}