StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named __proto__ invokes the inherited prototype setter instead of creating an ordinary own property, allowing the decoded object's prototype to contain attacker-controlled authorization or feature-flag values. Downstream code that trusts normal property lookup or merges the decoded object can therefore make security-sensitive decisions using inherited attacker data. This issue is fixed in version 2.0.4.

Affected: npm: @stablelib/cbor

### Summary

`@stablelib/cbor` decodes CBOR maps into ordinary JavaScript objects and assigns attacker-controlled keys directly onto those objects. A CBOR map key named `__proto__` therefore changes the prototype of the decoded object instead of becoming an ordinary data property.

### Details

The decoder builds map results with a plain `{}` and then stores attacker-controlled keys using bracket assignment.

That is unsafe for special property names. In JavaScript, assigning to `obj["__proto__"]` on a normal object does not create a plain own property. It invokes the built-in `__proto__` setter and replaces the object’s prototype if the supplied value is an object or `null`.

As a result, a CBOR payload containing a map entry like:

* key: `"__proto__"` * value: `{ isAdmin: true }`

does not decode to an object with an own property called `__proto__`. It decodes to an object whose prototype is now attacker-controlled. Any code that later reads properties through normal lookup will see inherited attacker-supplied values.

### PoC

```js import { decode } from "@stablelib/cbor";

// CBOR: // { // "__proto__": { "isAdmin": true } // } // // a1 map(1) // 69 text(9) // "__proto__" // a1 map(1) // 67 text(7) // "isAdmin" // f5 true

const payload = new Uint8Array([ 0xa1, 0x69, 0x5f, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x5f, 0x5f, 0xa1, 0x67, 0x69, 0x73, 0x41, 0x64, 0…