{"items":[{"id":"NVI-00013253","kind":"vulnerability","title":"Prototype Pollution via parse() in NodeJS flatted","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-rf6f-7fwh-wjgh","CVE-2026-33228"],"plain_summary":"GitHub lists this reviewed advisory for flatted. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-a6c2bc1c3c6a02696ad48ea6cf02c445"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a6c2bc1c3c6a02696ad48ea6cf02c445","url":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-rf6f-7fwh-wjgh","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T01:39:10.636Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a6c2bc1c3c6a02696ad48ea6cf02c445"],"technology":"flatted","known_exclusions":[],"conditions_summary":"---\n  **Summary**\n\n  The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index\n  keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it\n  with the key \"\\_\\_proto\\_\\_\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate\n   parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype\n   to the consumer. Any code that subsequently writes to that property will pollute the global prototype.\n\n  ---\n  **Root Cause**\n\n  File: esm/index.js:29 (identical in cjs/index.js)\n```\n  const resolver = (input, lazy, parsed, $) => output => {\n    for (let ke = keys(output), {length} = ke, y = 0; y < length; y++) {\n      const k = ke[y];\n      const value = output[k];    \n      if (value instanceof Primitive) {\n        const tmp = input[value];      // Bug is here\n```\n\nNo validation that value is a safe numeric index input is built as a plain Array. JavaScript's property lookup on arrays traverses the prototype chain for non-numeric  keys. The key \"\\_\\_proto\\_\\_\" resolves to Array.protot","public_affected_ranges":["<= 3.4.1"]}],"null_published_at":"2026-11-01T07:29:12.932Z","source_updated_at":"2026-10-05T15:48:47.000Z","source_disclosed_at":"2026-03-19T17:43:54.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T01:39:10.636Z"}],"next_cursor":null,"snapshot_revision":"42594"}