Prototype Pollution

Vulnerability

The Dexie.js library (versions before 3.2.2 and from 4.0.0-alpha.1 before 4.0.0-alpha.3) contains a prototype pollution vulnerability in the Dexie.setByKeyPath(obj, keyPath, value) function [1][4]. This function does not properly validate or block keys such as __proto__, constructor, or prototype, allowing an attacker to inject properties into the base Object.prototype [1]. The vulnerability can be triggered when untrusted user input is used as a key path, for example during collection modifications [1].

Exploitation

An attacker can exploit this by supplying a crafted key path like "__proto__.polluted" to the setByKeyPath function, which will then set a property on Object.prototype [1][4]. This requires the attacker to control the keyPath parameter passed to the vulnerable function, typically through user-supplied data that is not sanitized before being used in database operations [4]. No authentication is needed if the vulnerable code is exposed to client-side or server-side input; however, the specific attack vector depends on how the application uses Dexie.js.

Impact

Successful exploitation leads to prototype pollution, where an attacker can add or modify properties on Object.prototype [1][3]. This can result in unexpected behavior across the application, potential denial of service through JavaScript exceptions, or, in more severe cases, remote code execution if the polluted properties affect control flow or security checks [3][4]. The impact is limited by how the affected application uses the polluted object properties.

Mitigation

Users should upgrade to Dexie.js version 3.2.2 or later (for the 3.x line) or version 4.0.0-alpha.3 or later (for the 4.x line) [1][4]. There is no known workaround that fully mitigates the vulnerability without patching. The fix ensures that setByKeyPath properly blocks prototype-related keys. As of the publication date (2022-05-01), no KEV listing has been reported [1].