Executive brief
Redoc is a popular API documentation tool used to render and display OpenAPI specifications. A prototype pollution flaw in its mergeObjects function allows attackers to inject malicious properties into the JavaScript Object prototype, potentially causing service outages, incorrect application behavior, or enabling follow-on attacks. Applications using Redoc versions 2.2.0 and earlier are affected.
Technical details
A prototype pollution vulnerability exists in the `Module.mergeObjects` function (redoc/bundles/redoc.lib.js:2) due to insufficient input validation during recursive property merging. An attacker can supply a crafted JSON payload containing special properties (`__proto__` or `constructor.prototype`) to pollute the built-in Object.prototype without authentication or user interaction, since the vulnerability is triggered via the library's public API. This allows an attacker to inject arbitrary properties into all objects in the application, leading to denial of service through object corruption. The vulnerability affects all versions up to and including 2.2.0; a fix was released in version 2.4.0 by implementing proper property validation (e.g., hasOwnProperty checks or blocking reserved property names).
Affected products
- Redocly Redoc < 2.4.0
Timeline
- 2025-03-28: disclosed: Vulnerability published
- 2025-03-28: patched: Fix released in version 2.4.0