Loading story…
jQuery released version 3.4.0 to remediate a prototype-pollution vulnerability in its extend() function. Applications that recursively merged or deep-cloned attacker-controlled JSON could allow __proto__ properties to alter JavaScript object prototypes, potentially causing exceptions and denial of service or tampering with application behavior.
The flaw could turn inherited properties into security-relevant values—for example, making an otherwise undefined isAdmin check evaluate as true—depending on application code. Organizations using affected jQuery versions should upgrade to 3.4.0 or later, review deep-merge handling of untrusted input, and use safer object patterns such as null-prototype objects or Map where appropriate.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A prototype pollution vulnerability affecting jQuery was disclosed. The flaw involved unsafe recursive merging through jQuery's extend() API and could enable denial of service, application tampering, or privilege escalation in vulnerable applications processing attacker-controlled data.
The jQuery team released jQuery 3.4.0, which fixed the disclosed prototype pollution issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The maintainers of the Node.js package **`object-path`** released a series of fixes for prototype pollution flaws affecting applications that use the library in inherited-properties mode through **`includeInheritedProps`** or **`withInheritedProps`**. The vulnerable behavior involved methods such as **`set()`**, **`del()`**, **`empty()`**, **`push()`**, and **`insert()`**, where attacker-controlled paths could target magic properties like **`__proto__`** and **`constructor.prototype`** and potentially modify object prototypes. The package documentation states that the default `object-path` instance in versions `0.11.0` and later was not affected. A follow-up hardening change closed a bypass of the earlier mitigation by blocking dangerous paths supplied as non-string or non-numeric values, including nested array path components. Repository tests show the library now rejects attempts to write through prototype-linked paths and raises errors containing **"For security reasons"** when `objectPath.withInheritedProps.set` is used with those values. Version `0.11.8` also added protections to **`get()`**, causing it to throw when code attempts to access restricted properties such as **`__proto__`** or **`constructor`** in inherited-props mode.
Jun 29, 2026
Two newly disclosed flaws in **DOMPurify** can let attackers bypass the library’s sanitization logic and inject malicious attributes or unsafe URLs into supposedly cleaned HTML. One issue, tracked as **`GHSA-CJMM-F4JC-QW8R`**, affects deployments that use a predicate function with the `ADD_ATTR` configuration. If that predicate approves URI-bearing attributes such as `href` or `src`, DOMPurify can skip later mandatory safety checks, including protocol validation, allowing dangerous values such as `javascript:`, `vbscript:`, or `data:` to pass through and potentially trigger DOM-based cross-site scripting. A second flaw, **`GHSA-CJ63-JHHR-WCXV`**, stems from prototype pollution when the `USE_PROFILES` option is enabled. In vulnerable versions, DOMPurify initializes `ALLOWED_ATTR` as a standard JavaScript array, allowing inherited properties from `Array.prototype` to influence attribute validation. An attacker able to pollute `Array.prototype` with entries such as `onclick` can cause DOMPurify to treat malicious event-handler attributes as explicitly allowed, creating another path to XSS. Together, the disclosures show that applications relying on DOMPurify may remain exposed if they use dynamic attribute approval or operate in environments where prototype pollution is possible.
Jun 29, 2026
A high-severity vulnerability tracked as **`CVE-2026-73654`** affects **Trigger.dev** versions **3.3.8 through 4.5.5**, allowing prototype pollution through the **`PUT /api/v1/runs/:runId/metadata`** endpoint. The flaw lets an attacker with a normal environment API key supply malicious metadata keys such as **`__proto__`**, **`constructor`**, or **`prototype`**, which are passed into `JSONHeroPath().set()` and can modify `Object.prototype` in the shared web application process. The resulting corruption can cascade across tenants, causing Prisma query failures, Prometheus label corruption, broken worker authentication, and process-wide denial of service. The issue is classified as **CWE-1321** and carries a **CVSS v3.1** score vector of **`AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H``**, reflecting low-complexity network exploitation with high availability impact. Trigger.dev fixed the vulnerability in **version 4.5.6** by adding input validation, including `isSafeMetadataKey` checks and filtering of dangerous path segments before metadata reaches the path resolver. For self-hosted deployments that cannot patch immediately, recommended interim defenses include WAF rules that inspect HTTP `PUT` requests to the metadata endpoint and block JSON payloads containing unsafe prototype-related keys.
Aug 13, 2026