| शीर्षक | Ractive.js ractive 1.4.4 Prototype Pollution |
|---|
| विवरण | A prototype pollution vulnerability exists in Ractive 1.4.4.
Ractive exposes public keypath setter APIs such as Ractive#set(). The API accepts string keypaths and keypath maps. During assignment, Ractive splits the provided keypath, resolves intermediate models, and eventually writes the value to the resolved parent object. Prototype-related path segments such as proto, constructor, and prototype are not rejected before the write.
A crafted keypath such as proto.polluted can therefore cause writes to Object.prototype. After exploitation, newly created plain objects may inherit attacker-controlled properties.
The issue was reproduced through public Ractive setter APIs. Additional impact was observed through inherited configuration properties: after polluting Object.prototype.template or Object.prototype.data, later Ractive instances may consume inherited values during initialization, depending on how the application constructs component options.
Affected version:
Ractive 1.4.4
Impact:
Prototype pollution through public keypath setter APIs. Exploitability depends on applications passing untrusted or partially trusted keypaths, keypath maps, dynamic form fields, state sync updates, plugin data, API-driven UI state, or JSON-patch-style updates into Ractive setter APIs.
Recommended fix:
Reject __proto__, constructor, and prototype path segments in all keypath write APIs. Avoid writing through inherited prototype objects. Use own-property checks when reading initialization options such as template and data. |
|---|
| स्रोत | ⚠️ https://github.com/ractivejs/ractive/issues/3448 |
|---|
| उपयोगकर्ता | wjm3 (UID 99672) |
|---|
| सबमिशन | 09/07/2026 03:00 PM (2 महीनों पहले) |
|---|
| संयम | 23/08/2026 06:07 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 394565 [ractivejs ractive तक 1.4.4 Keypath Ractive#set दूरस्थ कोड निष्पादन] |
|---|
| अंक | 20 |
|---|