Description

A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component Keypath Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-24T04:16:58.847Z",
  "pubdate": "2026-08-24T04:16:58.847Z",
  "executiveSummary": "A prototype pollution vulnerability has been identified in ractivejs ractive versions up to 1.4.4, specifically within the Ractive#set function of the Keypath Handler component. This security flaw allows a remote, unauthenticated attacker to execute a manipulation that leads to improperly controlled modification of object prototype attributes across the JavaScript runtime environment.\nThe impact of this vulnerability is critical, as successful exploitation can compromise the integrity of the application's underlying JavaScript prototype chain, potentially leading to denial of service, property injection, or remote code execution depending on how downstream components consume modified object properties.\nPublicly available exploit code lowers the barrier to entry for potential threat actors. Because the maintainers have not yet responded to early issue reports or provided an official patch, systems utilizing vulnerable versions of ractivejs ractive remain exposed to remote exploitation without requiring specialized privileges.",
  "technicalDetails": "The vulnerability resides in the Ractive#set function of the Keypath Handler component within ractivejs ractive up to 1.4.4. The root cause stems from insecure object property assignment logic that fails to properly sanitize or validate keypaths before traversing and mutating nested object properties.\nWhen processing user-supplied input or dynamic keypaths containing administrative sequences such as __proto__, constructor, or prototype, the function improperly handles object assignments. Rather than safely restricting modifications to the intended target object instance, the internal assignment routine recursively traverses the prototype chain of the global Object constructor.\nThe attack flow initiates when a remote attacker supplies a crafted payload designed to target object prototype attributes via the vulnerable Ractive#set interface. Because network exposure allows remote transmission of malicious input without prior authentication or elevated privileges, the application processes the untrusted keypath directly within the execution context.\nAs the vulnerable component traverses the manipulated keypath, it assigns properties directly to Object.prototype. Consequently, every object instantiated within the JavaScript runtime inherits the injected properties and values. Depending on the specific properties polluted, this state alteration can subvert application logic, bypass security controls, trigger unexpected exceptions causing denial of service, or facilitate further exploitation vectors such as property injection.\nPost-exploitation impact is severe due to the global scope of prototype pollution in JavaScript environments, affecting all modules and components sharing the polluted prototype."
}