Prototype Pollution in Confetti Yayson
CVE-2026-61534
Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type is __proto__ causes model-cache writes to modify Object.prototype, with the attacker controlling the polluted property name through id and its value through attributes. The malicious type can also be supplied by an included resource, and LegacyStore is reachable when a configured types mapping resolves to __proto__. Unsafe relationship names including __proto__, constructor, and prototype provide additional document-derived member paths. The resulting process-wide prototype pollution can cause denial of service and logic corruption; authorization bypass or code execution depends on suitable gadgets in the consuming application. This issue is fixed in version 4.3.0.
Vulnerability class: Prototype Pollution
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (57.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 57.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Confetti Yayson — versions < 4.3.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-61534?
- CVE-2026-61534 is a critical-severity vulnerability in Confetti Yayson, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 9.1/10. Published 2026-09-14.
- How severe is CVE-2026-61534?
- Critical severity. CVSS v3 base score is 9.1 out of 10.