Executive brief
RubyLouvre avalon is a JavaScript framework used for building web interfaces. A vulnerability in how the framework handles template filters allows an attacker to manipulate the underlying data structures of the application. This can lead to unauthorized modification of application behavior and, in certain configurations, could allow an attacker to execute arbitrary code on the system.
Technical details
A prototype pollution vulnerability exists in RubyLouvre avalon (avalon2) versions 0.9.9 through 2.2.10 within the Template Filter Handler. The framework stores filters in a plain object (`avalon.filters`) and accesses them using bracket notation without `hasOwnProperty` checks in `src/filters/index.js`. This allows an attacker to traverse the prototype chain (e.g., accessing `constructor`). When combined with the template parser's use of `new Function()` in `src/parser/index.js` to compile expressions, a remote attacker can achieve code execution if they can influence template content. The project is currently unmaintained, and no official patch is available.
Affected products
- RubyLouvre avalon 0.9.9 to 2.2.10
- RubyLouvre avalon2 0.9.9 to 2.2.10
Timeline
- 2026-06-15: disclosed: Public disclosure of the vulnerability and exploit code.
- 2026-06-15: advisory: CVE-2026-12209 published.