Prototype Pollution

Vulnerability

The vulnerability resides in the getJsonFromUrl function of the litespeed.js package (versions before 0.3.12) and the appwrite/server-ce package (versions 0.12.0 through 0.12.2, and versions before 0.11.1). When parsing a query string, the function sets a key in the result object without sanitizing the key name, enabling an attacker to inject keys that modify an object's prototype. This is a classic Prototype Pollution vulnerability [1][2][3].

Exploitation

An attacker can craft a malicious URL containing a query parameter like __proto__ or constructor.prototype along with a value. When getJsonFromUrl processes this query string, the unvalidated key directly sets properties on Object.prototype. The attacker only needs to induce a user or server to parse the malicious URL—no authentication or special privileges are required beyond being able to supply the URL to the affected code [1][2][3].

Impact

Successful exploitation allows the attacker to pollute the global Object.prototype, thereby injecting properties that are inherited by all objects in the JavaScript runtime. This can lead to unexpected behavior, denial of service, or potentially arbitrary code execution depending on how the polluted properties are used by the application. The scope affects both client-side and server-side contexts where the vulnerable packages are used [1][2][3].

Mitigation

• For litespeed.js: upgrade to version 0.3.12 or later [3].
• For appwrite/server-ce: upgrade to version 0.11.1 (for users on 0.11.x) or version 0.12.2 (for users on 0.12.x) [2][4].
• There are no known workarounds other than upgrading to the patched versions. The project maintainers have issued security releases [2][3][4].