8.6
CVE-2026-48795
- EPSS 0.3%
- Veröffentlicht 15.07.2026 21:23:14
- Zuletzt bearbeitet 16.07.2026 19:16:49
- CVE-Watchlists
- Unerledigt
Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser
AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.__proto__.polluted and constructor.prototype still caused lodash _.set() via @poppinss/utils to create plain intermediate objects and pollute Object.prototype. This issue is fixed in versions 10.1.5 and 11.0.3.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstelleradonisjs
≫
Produkt
core
Version
>= 10.1.3, < 10.1.5
Status
affected
Version
>= 11.0.0-next.9, < 11.0.3
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.3% | 0.222 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 8.6 | 3.9 | 4.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
|
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
https://github.com/adonisjs/core/security/advisories/GHSA-qcm7-3vpr-hj5h
https://github.com/adonisjs/bodyparser/commit/8a85eb0c2061b0caca10faedbfc2cf24b56cf9f6
https://github.com/adonisjs/bodyparser/commit/aa96908f7b3f64c19e15d2d2d916b69137bdf469
https://github.com/adonisjs/bodyparser/releases/tag/v10.1.5
https://github.com/adonisjs/bodyparser/releases/tag/v11.0.3