GitHub Advisoryadvisory · npm

GHSA-r8c2-2qwq-94p6 rollbar vulnerable to prototype pollution

LOW Published 2025-10-20 Modified 2025-10-20 Official page ↗
Aliases
CVE-2025-57325
Ecosystem
npm
Packages
rollbar
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Weaknesses
CWE-1321
Reviewed
2025-10-20

Affected packages

• npm rollbar: < 2.26.5 → fixed in 2.26.5 • npm rollbar: >= 3.0.0-alpha1, < 3.0.0-beta5 → fixed in 3.0.0-beta5

Description

Impact Prototype pollution potential with the utility function `rollbar/src/utility`.`set()`. No impact when using the published public interface. If application code directly imports `set` from `rollbar/src/utility` and then calls `set` with untrusted input in the second argument, it is vulnerable to prototype pollution. POC: ```js const obj = {}; require("rollbar/src/utility").set(obj, "__proto__.polluted", "vulnerable"); console.log({}.polluted !== undefined ? '[POLLUTION_TRIGGERED]':''); ``` Patches Fixed in version 2.26.5 and 3.0.0-beta5. Workarounds If application code directly imports `set` from `rollbar/src/utility`, ensure that the second argument does not receive untrusted input. References https://github.com/rollbar/rollbar.js/issues/1333#issuecomment-3353720946

Related

Alias · CVE (1)

  • CVE-2025-57325 rollbar is a package designed to effortlessly track and debug errors in JavaScript applications. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References