Executive brief
RactiveJS is a popular JavaScript library for building reactive user interfaces with automatic UI updates. A prototype pollution vulnerability in the Ractive#set() method allows attackers to modify core JavaScript object properties, potentially poisoning all subsequent Ractive instances on a page with malicious templates or data. This could lead to cross-instance injection attacks, unauthorized script execution, and data manipulation affecting multiple users or sessions.
Technical details
The vulnerability is a prototype pollution flaw in the Ractive#set() keypath setter (ractive.js:6928-6947, Model.applyValue). The setter fails to validate or reject prototype-traversal path segments such as __proto__ and constructor.prototype before writing to the object model. An attacker can call Ractive#set('__proto__.polluted', value) to write arbitrary properties to Object.prototype. Additionally, the library consumes inherited prototype properties during instance initialization (template and data options), enabling cross-instance injection: a polluted __proto__.template affects all subsequently created Ractive instances, allowing injection of attacker-controlled HTML/scripts. Attack requires the attacker to influence the keypath argument passed to Ractive#set(), which may occur if user input is reflected into keypath parameters.
Affected products
- RactiveJS Ractive up to 1.4.4
Timeline
- 2026-07-02: disclosed: Vulnerability reported as GitHub issue #3448
- 2026-08-24: advisory: CVE-2026-78181 published to NVD