CVE-2026-33228

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-33228 is a prototype pollution vulnerability in the flatted JavaScript library, a circular JSON parser, affecting versions prior to 3.4.2. The issue arises in the parse() function, which uses attacker-controlled string values from the parsed JSON as direct array index keys without validating that they are numeric. When the internal input buffer—a JavaScript Array—is accessed with the key "__proto__", it returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, leaking a live reference to Array.prototype to the consumer application.

An attacker can exploit this vulnerability remotely over the network with low complexity and no privileges or user interaction required, as indicated by the CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). By crafting a malicious JSON string containing "__proto__" as a key, the attacker tricks the parser into polluting the prototype chain. If the consuming code subsequently writes properties to this leaked reference, it modifies the global Array.prototype, potentially leading to remote code execution, denial of service, or arbitrary code manipulation depending on the application's logic and further exploitation chains.

The vulnerability, classified under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), has been patched in flatted version 3.4.2. Security practitioners should upgrade to this version or later. Relevant resources include the patch commit at https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802, the release announcement at https://github.com/WebReflection/flatted/releases/tag/v3.4.2, and the GitHub security advisory at https://github.com/WebReflection/flatted/security/advisories/GHSA-rf6f-7fwh-wjgh.