Executive Summary

This vulnerability exists in the flatted circular JSON parser prior to version 3.4.2. The parse() function can use attacker-controlled string values from the parsed JSON as direct array index keys without validating that they are numeric.

Because the internal input buffer is a JavaScript Array, accessing it with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object.

As a result, this effectively leaks a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype, potentially causing unexpected behavior or security issues.

This issue was fixed in version 3.4.2 of flatted.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to prototype pollution by leaking a live reference to Array.prototype. If an attacker controls the input JSON, they can manipulate the global prototype by writing to the polluted property.

Such prototype pollution can cause unexpected behavior in applications, including security issues like privilege escalation, denial of service, or arbitrary code execution depending on how the polluted prototype is used.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the flatted package to version 3.4.2 or later, where the issue has been patched.

Useful 0 Not Useful 0