CVE-2023-26135

Vulnerability

Analysis

CVE-2023-26135 describes a Prototype Pollution vulnerability in the flatnest npm package, affecting all versions. The flaw resides in the nest() function within flatnest/nest.js [1]. The function is designed to reconstruct nested JavaScript objects from flattened key-value pairs, but it does not properly sanitize or validate keys that refer to the object prototype (e.g., __proto__, constructor). When an attacker provides a flat input with a key like __proto__.polluted, the nest() function will recursively assign values along that path, ultimately polluting Object.prototype [2].

Exploitation

Method

An attacker can exploit this vulnerability by supplying crafted input to any application that uses the flatnest library to nest user-controlled flat objects. Since the attack relies on the ability to set arbitrary keys in the flat input, no special network position is required beyond the ability to influence data passed to nest(). The input must contain a key path that traverses to __proto__ (or a similar prototype property). Because the nest() function processes string-based path segments without filtering out reserved prototype keys, the pollution succeeds [3][4].

Impact

Successful exploitation leads to Prototype Pollution, which can have severe consequences. By injecting properties into Object.prototype, an attacker can alter the default behavior of all objects in the JavaScript runtime. This can cause denial of service via unexpected exceptions, or more critically, modify application logic to bypass security controls thereby enabling privilege escalation or remote code execution [2]. The exact impact depends on how the polluted prototype properties are used by the target application.

Mitigation

Status

As of the publication date, the flatnest package has not released a patched version. Users are advised to avoid using the package or implement strict input validation to strip any key paths that reference prototype properties. The vulnerability has been cataloged in the Snyk database and the NVD, but no patch is available at this time [1][2].