Critical · published December 10, 2025
🚨 A sneaky prototype pollution vulnerability in Elysia can lead to full remote code execution with just the right conditions! 🔥 Think of this like a game of Jenga: if you stack two blocks with the same name, the wrong move could cause the whole tower to collapse, allowing an attacker to pull out a piece and take control. It’s a precarious balance that becomes a disaster if not handled correctly! An attacker could exploit this vulnerability to execute arbitrary code on your server, potentially gaining full control over your system. This could lead to data breaches, service interruption, or even worse, giving an attacker the keys to your entire operation! Yikes!
Think of this like a game of Jenga: if you stack two blocks with the same name, the wrong move could cause the whole tower to collapse, allowing an attacker to pull out a piece and take control. It’s a precarious balance that becomes a disaster if not handled correctly! This prototype pollution flaw occurs in the `mergeDeep` function when merging two standard schema validations sharing the same key. By manipulating the merging order, an attacker can inject malicious properties into an object, leading to remote code execution.
An attacker could exploit this vulnerability to execute arbitrary code on your server, potentially gaining full control over your system. This could lead to data breaches, service interruption, or even worse, giving an attacker the keys to your entire operation! Yikes! To secure your application, immediately upgrade Elysia to version 1.4.17 or later. If you can't update right away, a temporary workaround is to remove the `__proto__` key from the body of your requests. Stay proactive! You've got this! With these steps, you'll lock this vulnerability down in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| elysiajs/elysia | ≥ 1.4.0, < 1.4.17 | 1.4.17 |