GHSA-hxj9-33pp-j2cc

Опубликовано: 09 дек. 2025

Источник: github

Github: Прошло ревью

CVSS4: 9.1

Описание

Elysia vulnerable to prototype pollution with multiple standalone schema validation

Prototype pollution vulnerability in mergeDeep after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the __proto__ prop to be merged.

When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker.

Impact

Routes with more than 2 standalone schema validation, eg. zod

Example vulnerable code:

import { Elysia } from "elysia" import * as z from "zod" const app = new Elysia() .guard({ schema: "standalone", body: z.object({ data: z.any() }) }) .post("/", ({ body }) => ({ body, win: {}.foo }), { body: z.object({ data: z.object({ messageId: z.string("pollute-me"), }) }) })

Patches

Patched by 1.4.17 (https://github.com/elysiajs/elysia/pull/1564)

Reference commit:

Workarounds

Remove __proto__ key from body

Example plugin for removing __proto__ from body

new Elysia() .onTransform(({ body, headers }) => { if (headers['content-type'] === 'application/json') return JSON.parse(JSON.stringify(body), (k, v) => { if (k === '__proto__') return return v }) })

Ссылки

Пакеты

Наименование

elysia

npm

Затронутые версииВерсия исправления

>= 1.4.0, < 1.4.17

1.4.17

EPSS

Процентиль: 35%

0.00148

Низкий

9.1 Critical

CVSS4

CVE ID

CVE-2025-66456

Дефекты

CWE-1321

Связанные уязвимости

CVE-2025-66456

CVSS3: 9.8

nvd

около 2 месяцев назад

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 contain a prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an any type that is set as a standalone guard, to allow for the `__proto__ prop` to be merged. When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker. This issue is fixed in version 1.4.17. To workaround, remove the `__proto__ key` from body.

EPSS

Процентиль: 35%

0.00148

Низкий

9.1 Critical

CVSS4

CVE ID

CVE-2025-66456

Дефекты

CWE-1321