CVE-2026-78181
Received Received - Intake

Ractive.js Prototype Pollution via Ractive#set

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulDB

Description
A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component Keypath Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78181
EUVD
EUVD-2026-64704

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ractivejs ractive to 1.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a prototype pollution issue in Ractive.js version 1.4.4. It occurs in the Ractive#set function of the Keypath Handler component. Attackers can manipulate Object.prototype attributes by using prototype-related path segments like __proto__ or constructor.prototype. This allows them to inject polluted inherited properties into subsequent Ractive instances, potentially affecting template or data rendering.

Detection Guidance

To detect this vulnerability, inspect Ractive.js applications for use of keypath segments like __proto__, constructor.prototype, or prototype in Ractive#set operations. Check application logs for unusual property modifications or inherited attributes like template or data appearing unexpectedly. Review issue reports or GitHub repositories for Ractive.js instances using version 1.4.4 or earlier.

Impact Analysis

Exploitation could lead to cross-instance template or data injection, enabling arbitrary HTML or script execution in rendered output. It may also cause denial of service by overwriting built-in properties or unintended data pollution across Ractive.js applications.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized data manipulation or injection attacks. Prototype pollution may allow attackers to alter object properties, potentially leading to data integrity issues or unauthorized access to sensitive information. However, specific compliance impacts depend on how the affected Ractive.js library is used in a system.

Mitigation Strategies

Immediately upgrade Ractive.js to a version that blocks prototype-related keypath segments and validates write operations. If upgrading is not possible, implement input validation to reject __proto__, prototype, and constructor as keypath segments in Ractive#set calls. Add own-property checks during initialization to prevent prototype pollution. Monitor for signs of exploitation such as unexpected property inheritance or script execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78181. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart