CVE-2026-46509: deepobj: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Synopsis

Prototype pollution is a JavaScript vulnerability affecting the deepobj library (versions prior to 1.0.3). An unauthenticated remote attacker can reach it over the network with no authentication required, by supplying a crafted property path containing segments such as __proto__, constructor, or prototype to deepobj's get, set, or delete operations. Successful exploitation lets an attacker tamper with object prototype attributes shared across the application, corrupting application logic and causing partial service disruption. No fix version has been published upstream yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is needed.

• AuthenticationNot required

  No credentials or session token are needed; PR:N confirms the attacker can interact with the vulnerable code path anonymously.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is needed; UI:N means the attacker can complete the exploit entirely on their own.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or environmental prerequisites.

Blast Radius

• Attacker injects or overwrites properties on JavaScript object prototypes, silently altering shared application behavior across all objects that inherit from the polluted prototype.
• Attacker manipulates integrity-sensitive logic such as access-control checks, configuration flags, or data-processing branches that read inherited prototype properties.
• Attacker triggers partial service disruption by corrupting prototype state in ways that cause unhandled exceptions or undefined behavior in dependent application code (CVSS A:L).
• Confidentiality impact is none (C:N), so direct data disclosure is not a consequence of this vulnerability.