PT-2026-28539 · Convict · Convict
CVE-2026-33863
·
Publicado
2026-03-26
·
Atualizado
2026-03-27
CVSS v4.0
9.4
Crítica
| Vetor | AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Name of the Vulnerable Software and Affected Versions
Convict (affected versions not specified)
Description
The software contains two prototype pollution flaws not addressed by prior fixes. The first flaw exists in the
config.load() and config.loadFile() functions, where the overlay() function recursively merges configuration data without validating keys, allowing attackers to manipulate Object.prototype using input containing proto or constructor.prototype. The second flaw occurs during schema initialization, where passing a schema with constructor.prototype.* keys to convict() can directly write to Object.prototype during startup. Exploitation of these flaws, depending on how polluted properties are used, can lead to unexpected behavior, authentication bypass, or remote code execution. The vulnerable functions are config.load(), config.loadFile(), and convict(). The vulnerable parameters are schemas containing constructor.prototype.* keys and input data passed to load() and loadFile().Recommendations
Do not pass untrusted data to the
load() function.
Do not pass untrusted data to the loadFile() function.
Do not pass untrusted data to the convict() function.Correção
Prototype Pollution
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Convict