Executive brief
Elysia is a web framework for building APIs and web applications. A prototype pollution vulnerability in cookie handling allows an attacker to inject malicious properties into cookies, potentially leading to unauthorized access or modification of application data without requiring authentication or user interaction.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in Elysia's cookie parsing mechanism. By sending a specially crafted cookie with the name "__proto__" followed by a JSON payload, an attacker can pollute the prototype chain and override cookie values. The vulnerability affects all versions before 1.4.27 and requires only network access with no authentication or user interaction. An attacker can exploit this to read sensitive cookie data and modify cookie properties, potentially compromising session management and application logic. The vulnerability is patched in version 1.4.27.
Affected products
- Elysia Elysia < 1.4.27
Timeline
- 2026-03-17: disclosed
- 2026-03-17: patched: version 1.4.27