Description

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type is __proto__ causes model-cache writes to modify Object.prototype, with the attacker controlling the polluted property name through id and its value through attributes. The malicious type can also be supplied by an included resource, and LegacyStore is reachable when a configured types mapping resolves to __proto__. Unsafe relationship names including __proto__, constructor, and prototype provide additional document-derived member paths. The resulting process-wide prototype pollution can cause denial of service and logic corruption; authorization bypass or code execution depends on suitable gadgets in the consuming application. This issue is fixed in version 4.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-14T16:17:16.847Z",
  "pubdate": "2026-09-14T16:17:16.847Z",
  "executiveSummary": "Yayson versions prior to 4.3.0 are susceptible to a critical prototype pollution vulnerability due to insecure object property handling.\nThe vulnerability resides in the Store and LegacyStore modules, which utilize attacker-controlled JSON:API inputs as keys for object lookup tables.\nBy supplying malicious type, id, or relationship identifiers, an attacker can manipulate the global Object.prototype.\nThis impact is significant, potentially leading to denial of service, logic corruption, authorization bypass, or remote code execution, depending on the availability of execution gadgets within the application environment.\nThe vulnerability is triggered by parsing specifically crafted JSON:API documents, requiring no authentication if the application endpoint is publicly accessible.\nSuccessful exploitation allows an attacker to inject properties into all objects across the Node.js process, altering the application's runtime behavior in unexpected ways.",
  "technicalDetails": "The vulnerability originates in src/yayson/store.ts and src/yayson/legacy-store.ts, where the Yayson library implements caching mechanisms using plain JavaScript objects as lookup tables. These tables are indexed using unvalidated data extracted directly from JSON:API documents, specifically the 'type', 'id', and relationship name fields.\nThe root cause is the library's failure to sanitize these keys, permitting the injection of reserved JavaScript object properties such as '__proto__', 'constructor', and 'prototype'. When an attacker provides a JSON:API resource with a 'type' of '__proto__', the assignment operation intended to populate the model-cache writes directly to the prototype of all JavaScript objects.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious JSON:API payload where the 'type' field is set to '__proto__'. Second, the attacker defines the 'id' field as the key they wish to pollute on the prototype, and the 'attributes' field as the arbitrary value to be assigned. Third, when Yayson's Store or LegacyStore processes the document, the internal lookup mechanism performs an assignment such as object['__proto__'][id] = attributes. This triggers the prototype pollution, causing all objects within the application to inherit the malicious property.\nFurthermore, the vulnerability extends to relationship names; if an attacker controls the relationship key, they can traverse the object prototype chain or inject nested properties, providing deeper control over object members. In the context of LegacyStore, this is compounded if the configured types mapping resolves to '__proto__', exposing the underlying object structure to direct manipulation.\nThe severity of the resulting prototype pollution depends on the presence of gadget properties in the application or its dependencies. If the polluted property is used in security-sensitive contexts—such as authorization checks, property access, or function calls—an attacker may bypass security controls or achieve remote code execution. At a minimum, process-wide state corruption generally results in a denial of service due to unexpected object behavior or type errors occurring throughout the application runtime."
}