https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 13:12:06 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-106448 <p>StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named __proto__ invokes the inherited prototype setter instead of creating an ordinary own property, allowing the decoded object&#39;s prototype to contain attacker-controlled authorization or feature-flag values. Downstream code that trusts normal property lookup or merges the decoded object can therefore make security-sensitive decisions using inherited attacker data. This issue is fixed in version 2.0.4.</p> <p>StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named __proto__ invokes the inherited prototype setter instead of creating an ordinary own property, allowing the decoded object&#39;s prototype to contain attacker-controlled authorization or feature-flag values. Downstream code that trusts normal property lookup or merges the decoded object can therefore make security-sensitive decisions using inherited attacker data. This issue is fixed in version 2.0.4.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-106448 https://vulnerability.circl.lu/vuln/ghsa-w48f-fwg7-ww6p <p><strong>Affected:</strong> npm: @stablelib/cbor</p> <p>### Summary</p> <p>`@stablelib/cbor` decodes CBOR maps into ordinary JavaScript objects and assigns attacker-controlled keys directly onto those objects. A CBOR map key named `__proto__` therefore changes the prototype of the decoded object instead of becoming an ordinary data property.</p> <p>### Details</p> <p>The decoder builds map results with a plain `{}` and then stores attacker-controlled keys using bracket assignment.</p> <p>That is unsafe for special property names. In JavaScript, assigning to `obj[&#34;__proto__&#34;]` on a normal object does not create a plain own property. It invokes the built-in `__proto__` setter and replaces the object’s prototype if the supplied value is an object or `null`.</p> <p>As a result, a CBOR payload containing a map entry like:</p> <p>* key: `&#34;__proto__&#34;` * value: `{ isAdmin: true }`</p> <p>does not decode to an object with an own property called `__proto__`. It decodes to an object whose prototype is now attacker-controlled. Any code that later reads properties through normal lookup will see inherited attacker-supplied values.</p> <p>### PoC</p> <p>```js import { decode } from &#34;@stablelib/cbor&#34;;</p> <p>// CBOR: // { // &#34;__proto__&#34;: { &#34;isAdmin&#34;: true } // } // // a1 map(1) // 69 text(9) // &#34;__proto__&#34; // a1 map(1) // 67 text(7) // &#34;isAdmin&#34; // f5 true</p> <p>const payload = new Uint8Array([ 0xa1, 0x69, 0x5f, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x5f, 0x5f, 0xa1, 0x67, 0x69, 0x73, 0x41, 0x64, 0…</p> <p><strong>Affected:</strong> npm: @stablelib/cbor</p> <p>### Summary</p> <p>`@stablelib/cbor` decodes CBOR maps into ordinary JavaScript objects and assigns attacker-controlled keys directly onto those objects. A CBOR map key named `__proto__` therefore changes the prototype of the decoded object instead of becoming an ordinary data property.</p> <p>### Details</p> <p>The decoder builds map results with a plain `{}` and then stores attacker-controlled keys using bracket assignment.</p> <p>That is unsafe for special property names. In JavaScript, assigning to `obj[&#34;__proto__&#34;]` on a normal object does not create a plain own property. It invokes the built-in `__proto__` setter and replaces the object’s prototype if the supplied value is an object or `null`.</p> <p>As a result, a CBOR payload containing a map entry like:</p> <p>* key: `&#34;__proto__&#34;` * value: `{ isAdmin: true }`</p> <p>does not decode to an object with an own property called `__proto__`. It decodes to an object whose prototype is now attacker-controlled. Any code that later reads properties through normal lookup will see inherited attacker-supplied values.</p> <p>### PoC</p> <p>```js import { decode } from &#34;@stablelib/cbor&#34;;</p> <p>// CBOR: // { // &#34;__proto__&#34;: { &#34;isAdmin&#34;: true } // } // // a1 map(1) // 69 text(9) // &#34;__proto__&#34; // a1 map(1) // 67 text(7) // &#34;isAdmin&#34; // f5 true</p> <p>const payload = new Uint8Array([ 0xa1, 0x69, 0x5f, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x5f, 0x5f, 0xa1, 0x67, 0x69, 0x73, 0x41, 0x64, 0…</p> https://vulnerability.circl.lu/vuln/ghsa-w48f-fwg7-ww6p