CVE-2025-62517
BaseFortify
Publication date: 2025-10-23
Last updated on: 2025-10-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rollbar | rollbar.js | 2.26.4 |
| rollbar | rollbar.js | 3.0.0-beta4 |
| rollbar | rollbar.js | 3.0.0-alpha1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1321 | The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-62517 is a prototype pollution vulnerability in the rollbar.js library's merge() function. It occurs when application code calls rollbar.configure() with untrusted input, allowing an attacker to modify the prototype of JavaScript objects. This can lead to unauthorized changes in the application's behavior or data integrity issues. The vulnerability affects versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5. It was fixed by ensuring that objects modified do not have a prototype, preventing prototype pollution. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to perform prototype pollution, which can lead to unauthorized modification of data and potentially arbitrary code execution within the affected application. Although it does not affect confidentiality or availability, it has a high impact on integrity, meaning attackers can alter data or application behavior without permission. Exploitation requires complex conditions but no privileges or user interaction. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the version of the rollbar.js library used in your application. Versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5 are vulnerable. You can detect the vulnerable version by inspecting your project's package.json or using npm commands such as `npm list rollbar` or `npm ls rollbar`. Additionally, reviewing your application code for calls to `rollbar.configure()` with untrusted input can help identify potential exploitation points. There are no specific network detection commands provided in the resources. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading rollbar.js to version 2.26.5 or later, or to 3.0.0-beta5 or later, where the vulnerability has been fixed. As a workaround, ensure that values passed to `rollbar.configure()` do not contain untrusted input to prevent prototype pollution. Applying the patches from pull requests #1394 and #1390 also addresses the issue by preventing modifications to objects with prototypes. [2, 1, 3]