Executive brief
Elysia is a TypeScript web framework used to build HTTP APIs and web services. A prototype pollution vulnerability in the framework's schema validation allows attackers to inject malicious properties into JavaScript objects through specially crafted HTTP requests. When combined with another code injection flaw, this can lead to complete compromise of the application running the framework.
Technical details
The vulnerability exists in the mergeDeep function used when processing multiple standalone schema validations with the same key. When merging validation results, the code fails to sanitize the __proto__ property, allowing an attacker to pollute the prototype chain and inject arbitrary properties into all objects. The attack requires routes with more than 2 standalone schema validators and relies on an "any" type in the schema guard. The vulnerability is network-reachable with no authentication required. When chained with GHSA-8vch-m3f4-q8jf (arbitrary code injection through cookie config), it enables remote code execution. Patched in version 1.4.17.
Affected products
- Elysia Elysia 1.4.0 to 1.4.16
Timeline
- 2025-12-09: disclosed
- 2025-12-09: patched: Fixed in version 1.4.17