Executive brief
The @alizeait/unflatto library is a JavaScript utility for converting flattened objects into nested structures, commonly used in data transformation pipelines. A prototype pollution vulnerability allows attackers to inject malicious properties into the Object.prototype, potentially causing application crashes (denial of service), cross-site scripting attacks, or remote code execution depending on how the application uses the flattened data.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the exports.unflatto method at /dist/index.js, where untrusted input properties are unsafely assigned to the destination object without validating against reserved property names like __proto__ or constructor.prototype. An attacker can craft malicious input containing __proto__.polluted or similar payloads to pollute Object.prototype, affecting all objects in the application. The vulnerability affects all versions up to and including 1.0.2 and is triggered via direct invocation of the unflatto function with attacker-controlled input. Remediation requires blocking reserved property names or using only own properties during assignment (e.g., hasOwnProperty checks). A patch should be available from the maintainers.
Affected products
- alizeait unflatto <=1.0.2
Timeline
- 2024-03-15: disclosed: Vulnerability reported on GitHub
- 2025-03-28: advisory: GHSA-799q-f2px-wx8c published
- 2025-04-01: other: Advisory withdrawn as duplicate of GHSA-q8jq-4rm5-4hm5