PT-2026-28539 · Convict · Convict
Published
2026-03-26
·
Updated
2026-03-27
·
CVE-2026-33863
CVSS v4.0
9.4
Critical
| Vector | AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Name of the Vulnerable Software and Affected Versions
Convict (affected versions not specified)
Description
The software contains two prototype pollution flaws not addressed by prior fixes. The first flaw exists in the
config.load() and config.loadFile() functions, where the overlay() function recursively merges configuration data without validating keys, allowing attackers to manipulate Object.prototype using input containing proto or constructor.prototype. The second flaw occurs during schema initialization, where passing a schema with constructor.prototype.* keys to convict() can directly write to Object.prototype during startup. Exploitation of these flaws, depending on how polluted properties are used, can lead to unexpected behavior, authentication bypass, or remote code execution. The vulnerable functions are config.load(), config.loadFile(), and convict(). The vulnerable parameters are schemas containing constructor.prototype.* keys and input data passed to load() and loadFile().Recommendations
Do not pass untrusted data to the
load() function.
Do not pass untrusted data to the loadFile() function.
Do not pass untrusted data to the convict() function.Fix
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Convict