Executive brief
Rollbar's JavaScript library contains a prototype pollution vulnerability in an internal utility function. While the public API is not affected, applications that directly import and use the internal `set()` function from rollbar with untrusted input could allow attackers to pollute object prototypes, potentially affecting application behavior or security. This primarily impacts developers using undocumented internal APIs rather than standard Rollbar usage.
Technical details
A prototype pollution vulnerability exists in the rollbar/src/utility.set() function, which fails to sanitize property names in the second argument. When called with attacker-controlled input containing proto-pollution payloads (e.g., "__proto__.property"), the function modifies the Object prototype chain. The vulnerability requires direct import of the internal utility function—not exposed in the public API—and untrusted input to the key parameter. An attacker can pollute object prototypes to modify default behavior across the application. The vulnerability is fixed in versions 2.26.5 and 3.0.0-beta5. Versions ≤2.26.4 and ≥3.0.0-alpha1 and ≤3.0.0-beta4 are affected.
Affected products
- Rollbar rollbar <=2.26.4, >=3.0.0-alpha1 and <=3.0.0-beta4
Timeline
- 2025-10-20: disclosed
- 2025-10-20: patched: Fixed in versions 2.26.5 and 3.0.0-beta5