PT-2025-49872 · Elysia · Elysia

Sportshead · Published 2025-12-09 · Updated 2025-12-17 · CVE-2025-66456

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elysia versions 1.4.0 through 1.4.16

Description Elysia is a Typescript framework used for request validation, type inference, OpenAPI documentation, and client-server communication. The mergeDeep function is susceptible to a prototype pollution issue when merging results from two standard schema validations sharing the same key. This occurs due to the order of merging, requiring an 'any' type set as a standalone guard to allow merging of the proto property. Combined with GHSA-8vch-m3f4-q8jf, this can lead to remote code execution (RCE). The vulnerable component is the mergeDeep function. The proto property is involved in the exploitation.

Recommendations Update to Elysia version 1.4.17 or higher. As a workaround, remove the proto key from the request body.

Exploit

Fix

RCE

Prototype Pollution

Code Injection

Weakness Enumeration

CWE-1321

CWE-94

Related Identifiers

CVE-2025-66456

GHSA-8VCH-M3F4-Q8JF

GHSA-HXJ9-33PP-J2CC

Affected Products

Elysia

References · 20

• 🔥 https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc · Exploit
• 🔥 https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66456.json · Exploit
• 🔥 https://github.com/sportshead/elysia-poc · Exploit
• https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e · Patch
• https://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849e · Patch
• https://github.com/elysiajs/elysia/pull/1564 · Patch
• https://osv.dev/vulnerability/GHSA-hxj9-33pp-j2cc · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8vch-m3f4-q8jf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66456 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66457 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66456 · Vendor Advisory
• https://github.com/elysiajs/elysia · Note
• https://t.me/cveNotify/146088 · Telegram Post
• https://twitter.com/saltyAom/status/1998355677241364707 · Twitter Post