FKIE_CVE-2025-62517

Vulnerability from fkie_nvd - Published: 2025-10-23 20:15 - Updated: 2026-10-08 11:10
Severity
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible. This issue has been fixed in versions 2.26.5 and 3.0.0-beta5. A workaround involves ensuring that values passed to rollbar.configure() do not contain untrusted input.
References
security-advisories@github.comhttps://github.com/rollbar/rollbar.js/commit/61032fe6c208b71e249514800808a54bcb8cb8bb
security-advisories@github.comhttps://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343
security-advisories@github.comhttps://github.com/rollbar/rollbar.js/pull/1390
security-advisories@github.comhttps://github.com/rollbar/rollbar.js/pull/1394
security-advisories@github.comhttps://github.com/rollbar/rollbar.js/security/advisories/GHSA-xcg2-9pp4-j82x
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "rollbar.js",
          "vendor": "rollbar",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.26.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0-alpha1, \u003c 3.0.0-beta5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible. This issue has been fixed in versions 2.26.5 and 3.0.0-beta5. A workaround involves ensuring that values passed to rollbar.configure() do not contain untrusted input."
    },
    {
      "lang": "es",
      "value": "Rollbar.js ofrece seguimiento y registro de errores de Javascript a Rollbar. En versiones anteriores a la 2.26.5 y desde la 3.0.0-alpha1 hasta antes de la 3.0.0-beta5, existe una vulnerabilidad de contaminaci\u00f3n de prototipos en merge(). Si el c\u00f3digo de la aplicaci\u00f3n llama a rollbar.configure() con entrada no confiable, la contaminaci\u00f3n de prototipos es posible. Este problema ha sido solucionado en las versiones 2.26.5 y 3.0.0-beta5. Una soluci\u00f3n alternativa implica asegurar que los valores pasados a rollbar.configure() no contengan entrada no confiable."
    }
  ],
  "id": "CVE-2025-62517",
  "lastModified": "2026-10-08T11:10:00.250",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-62517",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-10-23T20:13:17.247458Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-10-23T20:15:41.057",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rollbar/rollbar.js/commit/61032fe6c208b71e249514800808a54bcb8cb8bb"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rollbar/rollbar.js/pull/1390"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rollbar/rollbar.js/pull/1394"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rollbar/rollbar.js/security/advisories/GHSA-xcg2-9pp4-j82x"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.