joaonuno flat-to-nested-js up to 1.1.1 Prototype Pollution index.js FlatToNested.prototype.convert id/parent prototype pollution

Summaryinfo

A vulnerability has been found in joaonuno flat-to-nested-js up to 1.1.1 and classified as critical. This vulnerability affects the function FlatToNested.prototype.convert of the file index.js of the component Prototype Pollution. The manipulation of the argument id/parent leads to prototype pollution. This vulnerability is uniquely identified as CVE-2026-55091. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in joaonuno flat-to-nested-js up to 1.1.1 and classified as critical. This issue affects the function FlatToNested.prototype.convert of the file index.js of the component Prototype Pollution. The manipulation of the argument id/parent with an unknown input leads to a prototype pollution vulnerability. Using CWE to declare the problem leads to CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is __proto__, temp[parent] can resolve to Object.prototype, and initPush() can write attacker-controlled data to the global children prototype property while existing prototype methods remain intact. Any application that passes attacker-influenced flat records to convert() can therefore expose unrelated objects to polluted inherited state, causing application-logic corruption or denial of service and potentially enabling greater impact when a downstream prototype-pollution gadget is present. The constructor and prototype strings are also unsafe inherited-key values in the same lookup design. This issue is fixed in version 1.1.2.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-55091 since 06/16/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059 for this issue.

Upgrading to version 1.1.2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• joaonuno

Name

• flat-to-nested-js

Version

• 1.1.0
• 1.1.1

Website

• Product: https://github.com/joaonuno/flat-to-nested-js/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion