{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ayayson_projectyaysonnode.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:yayson_project:yayson:*:*:*:*:*:node.js:*:*"],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["yayson (\u003c= 4.2.0)"],"_cs_severities":["high"],"_cs_tags":["prototype-pollution","deserialization","remote-code-execution","nodejs"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe \u003ccode\u003eyayson\u003c/code\u003e library for Node.js contains a critical prototype pollution vulnerability in its \u003ccode\u003eStore\u003c/code\u003e and \u003ccode\u003eLegacyStore\u003c/code\u003e components, tracked as CVE-2026-61534. The library uses incoming JSON:API document fields, specifically \u003ccode\u003etype\u003c/code\u003e and relationship names, as keys for internal lookup tables without proper sanitization. Because these tables are initialized as plain JavaScript objects, an attacker can supply a document where the \u003ccode\u003etype\u003c/code\u003e field is set to \u003ccode\u003e__proto__\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis operation writes directly onto the \u003ccode\u003eObject.prototype\u003c/code\u003e, affecting every object within the Node.js process lifetime. The vulnerability is highly impactful as it enables logic corruption or denial of service by design. Furthermore, if the host application contains suitable gadget chains, this pollution can be escalated to arbitrary code execution or authorization bypass. The vulnerability persists even when using \u003ccode\u003eincluded\u003c/code\u003e resources or custom type mappings, making it difficult to mitigate through standard input validation if the application relies on deeply nested data structures.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious JSON:API document containing a \u003ccode\u003edata\u003c/code\u003e object with \u003ccode\u003etype\u003c/code\u003e set to \u003ccode\u003e__proto__\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe target application receives the document via a network request and passes it to the \u003ccode\u003eyayson\u003c/code\u003e \u003ccode\u003eStore.sync()\u003c/code\u003e or \u003ccode\u003eLegacyStore\u003c/code\u003e deserialization method.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eyayson\u003c/code\u003e parses the JSON:API object and processes the \u003ccode\u003etype\u003c/code\u003e string as a property key for the internal \u003ccode\u003emodels\u003c/code\u003e lookup table.\u003c/li\u003e\n\u003cli\u003eThe library performs an assignment operation: \u003ccode\u003emodels[\u0026quot;__proto__\u0026quot;][id] = model\u003c/code\u003e, which effectively injects properties into the global \u003ccode\u003eObject.prototype\u003c/code\u003e because \u003ccode\u003e__proto__\u003c/code\u003e references the prototype of the \u003ccode\u003emodels\u003c/code\u003e object.\u003c/li\u003e\n\u003cli\u003eThe attacker includes malicious payloads within the \u003ccode\u003eattributes\u003c/code\u003e or \u003ccode\u003eid\u003c/code\u003e fields of the JSON:API document, which are then persisted globally across the process.\u003c/li\u003e\n\u003cli\u003eThe application performs subsequent object operations that trigger the injected malicious properties, leading to code logic alterations or unauthorized state changes.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages existing gadget chains in the application environment to execute arbitrary code or bypass security controls based on the polluted prototype properties.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an unauthenticated attacker to permanently alter the behavior of the Node.js application process. Successful exploitation leads to process-wide logic corruption and denial of service. Depending on the downstream application code, the impact can extend to authorization bypass or full remote code execution. This affects all users of \u003ccode\u003eyayson\u003c/code\u003e versions 3.x and 4.x up to and including 4.2.0.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u003ccode\u003eyayson\u003c/code\u003e library to version 4.3.0 or later to include null-prototype lookup table implementations.\u003c/li\u003e\n\u003cli\u003eImplement a temporary mitigation by rejecting incoming JSON documents where \u003ccode\u003etype\u003c/code\u003e or relationship names are set to \u003ccode\u003e__proto__\u003c/code\u003e, \u003ccode\u003econstructor\u003c/code\u003e, or \u003ccode\u003eprototype\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eExecute Node.js processes with the \u003ccode\u003e--disable-proto=throw\u003c/code\u003e flag to prevent prototype access if the environment permits.\u003c/li\u003e\n\u003cli\u003eAudit applications using \u003ccode\u003eyayson\u003c/code\u003e to identify usage of deep object merging or deserialization of untrusted user-supplied JSON:API payloads.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-12T00:56:54Z","date_published":"2026-09-12T00:56:54Z","id":"https://feed.craftedsignal.io/briefs/2026-09-yayson-prototype-pollution/","summary":"The yayson library (\u003c= 4.2.0) is vulnerable to prototype pollution when deserializing malicious JSON:API documents, allowing unauthenticated attackers to corrupt the global Object.prototype and potentially achieve RCE via gadget chains.","title":"Prototype Pollution in yayson Store and LegacyStore","url":"https://feed.craftedsignal.io/briefs/2026-09-yayson-prototype-pollution/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:yayson_project:yayson:*:*:*:*:*:node.js:*:*","version":"https://jsonfeed.org/version/1.1"}