Skip to content
Threat Feed
Subscribe

Product

Yayson (<= 4.2.0)

1 brief RSS
high advisory

Prototype Pollution in yayson Store and LegacyStore

The yayson library (<= 4.2.0) is vulnerable to prototype pollution when deserializing malicious JSON:API documents, allowing unauthenticated attackers to corrupt the global Object.prototype and potentially achieve RCE via gadget chains.

yayson prototype-pollution deserialization remote-code-execution nodejs
1t