Executive brief
Enquirer is a popular Node.js library used to create interactive command-line prompts for tools like webpack and yarn. A security flaw allows an attacker to manipulate how the library handles prompt names, potentially allowing them to modify core application settings. This can lead to application crashes, unexpected behavior, or unauthorized changes to how the software operates.
Technical details
A prototype pollution vulnerability exists in Enquirer versions up to and including 2.4.1. The root cause is located in the internal path setter used by the Enquirer.set function within the Public Package API. When a prompt is submitted, the library uses the externally supplied 'question.name' as a path to store the answer. Because the library fails to sanitize or reject dangerous path segments such as '__proto__', 'constructor', or 'prototype', an attacker can provide a crafted name (e.g., '__proto__.polluted') to mutate the Object prototype. This can be exploited remotely if an application passes untrusted input into prompt definitions, potentially resulting in denial of service or remote code execution depending on the application's environment.
Affected products
- enquirer enquirer up to 2.4.1
Timeline
- 2026-06-08: disclosed: Issue reported to maintainers via GitHub issue #487
- 2026-07-09: advisory: NVD publication date