CVE-2026-107301

Published: Ott 08, 2026 Last Modified: Ott 08, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: low

Description

AI Translation Available

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a __proto__ key can then replace the decoded object's prototype, potentially changing inherited properties or downstream behavior, although Object.prototype is not modified globally. This issue is fixed in version 6.1.0.

1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Incomplete
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability
Potential Impacts:
Read Application Data Modify Application Data Dos: Crash, Exit, Or Restart
Applicable Platforms
Languages: JavaScript
View CWE Details
https://github.com/mcollina/msgpack5/commit/20e82600ac9462e…
https://github.com/mcollina/msgpack5/commit/20e82600ac9462e679c8a45e5723315f21e…
https://github.com/mcollina/msgpack5/releases/tag/v6.1.0
https://github.com/mcollina/msgpack5/releases/tag/v6.1.0
https://github.com/mcollina/msgpack5/security/advisories/GH…
https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m