CVE-2026-33228 in flatted
Summary
by MITRE • 03/21/2026
flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/27/2026
The vulnerability identified as CVE-2026-33228 affects the flatted library, a circular JSON parser implementation that processes JSON data containing circular references. This library serves as a utility for serializing and deserializing JavaScript objects that may contain circular dependencies, making it a critical component in many applications that handle complex data structures. The flaw exists in the parse() function where the library fails to validate input string values before using them as array index keys, creating a path for prototype pollution attacks.
The technical root cause stems from improper input validation within the parsing mechanism. When flatted processes JSON data, it internally maintains an input buffer implemented as a JavaScript Array. The vulnerability occurs because the library does not validate whether string keys from parsed JSON are numeric before using them as array indices. This allows attackers to inject string values like "_proto_" which, when used as array keys, trigger JavaScript's prototype chain resolution mechanism. Since JavaScript Arrays inherit from Array.prototype, accessing array indices with "_proto_" returns the Array.prototype object through its inherited getter mechanism.
This design flaw enables attackers to manipulate the prototype chain of the output object being constructed during parsing. When the parsed JSON contains a key named "_proto_", the library treats this as a legitimate property assignment rather than a prototype manipulation attempt. The resulting object receives a reference to Array.prototype as a property value, which then becomes accessible to the application consuming the parsed data. Any subsequent code that writes to this property effectively modifies Array.prototype itself, leading to prototype pollution that can affect all objects inheriting from Array.prototype.
The operational impact of this vulnerability is significant as it allows for arbitrary prototype pollution attacks that can compromise application security. Attackers can leverage this vulnerability to modify core JavaScript objects and their behavior, potentially leading to code execution, data manipulation, or denial of service conditions. The vulnerability affects applications that use flatted for parsing untrusted JSON data, particularly those that do not implement additional input validation layers. This issue aligns with CWE-471, which addresses the use of a non-constant value in a context where a constant is required, and maps to ATT&CK technique T1548.005 for prototype pollution.
The security implications extend beyond simple prototype manipulation as the polluted prototype can affect numerous application components that rely on Array methods and properties. Applications using the vulnerable version of flatted are at risk of having their prototype chain corrupted, which can lead to unexpected behavior in JavaScript engines and potentially enable more sophisticated attacks. The patch implemented in version 3.4.2 resolves this issue by adding proper validation to ensure that only numeric indices are used as array keys, preventing non-numeric strings from being treated as valid array indices that could trigger prototype chain resolution. Organizations should immediately upgrade to version 3.4.2 or later to mitigate this vulnerability and ensure that their applications remain secure against prototype pollution attacks that exploit this specific flaw in the flatted library's parsing implementation.