{"id":"CVE-2026-107301","published":"2026-10-08T17:17:16.143","lastModified":"2026-10-14T01:17:05.583","description":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a __proto__ key can then replace the decoded object's prototype, potentially changing inherited properties or downstream behavior, although Object.prototype is not modified globally. This issue is fixed in version 6.1.0.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","cwes":["CWE-1321"],"vendors":[],"products":[],"references":[{"url":"https://github.com/mcollina/msgpack5/commit/20e82600ac9462e679c8a45e5723315f21e2c774","tags":[]},{"url":"https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","tags":[]},{"url":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m","tags":[]}],"exploitRefs":[{"url":"https://github.com/mcollina/msgpack5/commit/20e82600ac9462e679c8a45e5723315f21e2c774","tags":[]},{"url":"https://github.com/mcollina/msgpack5/releases/tag/v6.1.0","tags":[]},{"url":"https://github.com/mcollina/msgpack5/security/advisories/GHSA-8hq7-ggx2-cc6m","tags":[]}],"hasPoc":true,"ai":null}