kritik
CVE-2026-33228
flatted: Flatted: Prototype pollution vulnerability allows arbitrary code execution via crafted JSON.
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Red Hat. Daha düşük diyenler: GHSA (yüksek).
Açıklama
flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Red Hat | org.keycloak-keycloak-parent | düzeltme belirtilmemiş |
| chainguard | arangodb-3.11, arangodb-3.12, authentik-2026.2 ve 31 tane daha | 3.11.14.3-r4 ve 32 tane daha |
| debian 11 | node-flatted | düzeltme belirtilmemiş |
| debian 12 | node-flatted | düzeltme belirtilmemiş |
| debian 13 | node-flatted | 3.2.7~ds-1+deb13u1 |
| debian 14 | node-flatted | 3.4.2~ds-1 |
| echo | node-flatted | 3.2.7~ds-1+deb13u1 |
| minimos | argo-workflows-3.7, argo-workflows-fips-3.7, nginx-proxy-manager-2 ve 1 tane daha | 3.7.12-r0 ve 2 tane daha |
| npm::GitHub Security Advisory npm | flatted | 3.4.2 |
| rapidfort debian 12 | node-flatted | 0:3.2.7~ds-1+deb13u1 |
| rapidfort debian 13 | node-flatted | 0:3.2.7~ds-1+deb13u1 |
| wolfi | eslint, kubeflow-katib, langfuse-3 ve 4 tane daha | 10.1.0-r0 ve 6 tane daha |
12 kaynaktaki 54 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Red Hat | org.keycloak-keycloak-parent | düzeltme belirtilmemiş |
| chainguard | arangodb-3.11 | 3.11.14.3-r4 |
| chainguard | arangodb-3.12 | 3.12.9.4-r5 |
| chainguard | authentik-2026.2 | 2026.2.4-r10 |
| chainguard | authentik-fips-2026.2 | 2026.2.4-r9 |
| chainguard | drupal-11.3 | 11.3.13-r3 |
| chainguard | eslint | 10.1.0-r0 |
| chainguard | gitlab-rails-ce-18.1 | 18.1.6-r27 |
| chainguard | gitlab-rails-ce-18.11 | 18.11.6-r11 |
| chainguard | gitlab-rails-ce-19.0 | 19.0.5-r12 |
| chainguard | gitlab-rails-ce-19.1 | 19.1.7-r6 |
| chainguard | gitlab-rails-ce-19.2 | 19.2.5-r2 |
| chainguard | gitlab-rails-ce-19.3 | 19.3.1-r6 |
| chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r89 |
| chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| chainguard | gitlab-rails-ce-fips-18.11 | 18.11.7-r3 |
| chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| chainguard | gitlab-rails-ce-fips-19.0 | 19.0.5-r1 |
| chainguard | gitlab-rails-ce-fips-19.1 | 19.1.3-r1 |
| chainguard | gitlab-rails-ce-fips-19.2 | 19.2.5-r2 |
| chainguard | gitlab-rails-ce-fips-19.3 | 19.3.1-r3 |
| chainguard | kubeflow-katib | 0.19.0-r40 |
| chainguard | langfuse-2 | 2.95.12-r16 |
| chainguard | langfuse-3 | 3.163.0-r0 |
| chainguard | langfuse-fips-2 | 2.95.12-r19 |
| chainguard | langfuse-fips-3 | 3.162.0-r1 |
| chainguard | librechat | 0.8.4-r3 |
| chainguard | prism | 5.14.3-r13 |
| chainguard | renovate | 43.84.0-r1 |
| chainguard | semaphore | 2.18.12-r2 |
| chainguard | sqlpad | 7.5.7-r27 |
| chainguard | vitess-22 | 22.0.4-r9 |
| chainguard | vitess-23 | 23.0.3-r9 |
| chainguard | wazuh-dashboard | 4.14.6-r2 |
| chainguard | wazuh-dashboard-fips | 4.14.6-r1 |
| debian 11 | node-flatted | düzeltme belirtilmemiş |
| debian 12 | node-flatted | düzeltme belirtilmemiş |
| debian 13 | node-flatted | 3.2.7~ds-1+deb13u1 |
| debian 14 | node-flatted | 3.4.2~ds-1 |
| echo | node-flatted | 3.2.7~ds-1+deb13u1 |
| minimos | argo-workflows-3.7 | 3.7.12-r0 |
| minimos | argo-workflows-fips-3.7 | 3.7.12-r0 |
| minimos | nginx-proxy-manager-2 | 2.13.1-r0 |
| minimos | verdaccio | 6.8.0-r0 |
| npm::GitHub Security Advisory npm | flatted | 3.4.2 |
| rapidfort debian 12 | node-flatted | 0:3.2.7~ds-1+deb13u1 |
| rapidfort debian 13 | node-flatted | 0:3.2.7~ds-1+deb13u1 |
| wolfi | eslint | 10.1.0-r0 |
| wolfi | kubeflow-katib | 0.19.0-r40 |
| wolfi | langfuse-3 | 3.163.0-r0 |
| wolfi | prism | 5.14.3-r13 |
| wolfi | renovate | 43.84.0-r1 |
| wolfi | sqlpad | 7.5.7-r27 |
| wolfi | vitess-23 | 23.0.3-r9 |
Referanslar
- https://access.redhat.com/errata/RHSA-2026:13826
- https://access.redhat.com/errata/RHSA-2026:34342
- https://access.redhat.com/errata/RHSA-2026:9742
- https://access.redhat.com/security/cve/CVE-2026-33228
- https://bugzilla.redhat.com/show_bug.cgi?id=2449872
- https://github.com/WebReflection/flatted
- https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802
- https://github.com/WebReflection/flatted/releases/tag/v3.4.2