CVE-2026-33228

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 8.9EPSS 1%

Published 2026-03-20Updated 2026-03-20

Vulnerability details

flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CNAGitHub_M

EPSS score history

Sources

3 links

PoC links are not available for guest users. Login to view them.

CVE Organization NVD Analysis RedHat Vuln DB

Profile

CVSS

8.9

EPSS

Published

2026-03-20

Updated

2026-03-20

CNA

GitHub_M

Vendors

WebReflection

1 product

CPEs

cpe:/a:redhat:rhdh:1.8::el9

cpe:/a:redhat:rhdh:1.9::el9

cpe:/a:redhat:red_hat_3scale_amp:2

cpe:/a:redhat:build_keycloak:

cpe:/a:redhat:red_hat_single_sign_on:7

cpe:/a:redhat:cryostat:4

cpe:/a:redhat:logging:5

cpe:/a:redhat:multicluster_engine

cpe:/a:redhat:acm:2

cpe:/a:redhat:amq_broker:7

cpe:/a:redhat:service_registry:2

cpe:/a:redhat:optaplanner:::el6

cpe:/a:redhat:podman_desktop:1

cpe:/a:redhat:jboss_data_grid:8

cpe:/a:redhat:directory_server:11

cpe:/a:redhat:directory_server:12

cpe:/a:redhat:directory_server:13

cpe:/o:redhat:enterprise_linux:10

cpe:/o:redhat:enterprise_linux:8

cpe:/o:redhat:enterprise_linux:9

cpe:/a:redhat:jboss_fuse:7

cpe:/a:redhat:jboss_enterprise_application_platform:7

cpe:/a:redhat:jboss_enterprise_application_platform:8

cpe:/a:redhat:jbosseapxp

cpe:/a:redhat:openshift_ai

cpe:/a:redhat:openshift:4

cpe:/a:redhat:jboss_enterprise_bpms_platform:7

cpe:/a:redhat:quay:3

cpe:/a:redhat:amq_streams:2

cpe:/a:redhat:amq_streams:3

cpe:/a:redhat:cluster_observability_operator:1.5::el9

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated