Executive brief
Convict is a Node.js configuration management library used by applications to load and validate application settings. A prototype pollution vulnerability allows attackers to inject malicious properties into JavaScript's Object.prototype through untrusted configuration data, potentially leading to authentication bypass, application crashes, or remote code execution depending on how the polluted properties are used.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in Convict's overlay() function and schema initialization logic. The overlay() method recursively merges configuration data without validating forbidden keys like __proto__ or constructor.prototype; untrusted input (e.g., from JSON files via load() or loadFile()) can reach Object.prototype and write attacker-controlled values. Similarly, passing a schema with constructor.prototype.* keys to convict() causes default-value propagation to pollute Object.prototype at startup. The attack requires no authentication or user interaction—only that the application passes untrusted data to load(), loadFile(), or the constructor. Impact ranges from unexpected behavior to authentication bypass or RCE if polluted properties are consumed by dangerous sinks. The vulnerability is fixed in version 6.2.5.
Affected products
- Mozilla Convict <= 6.2.4
Timeline
- 2026-03-26: disclosed: Advisory GHSA-hf2r-9gf9-rwch published