Rollbar.js CVE-2025-62517

Exploitation requires that the consuming application call rollbar.configure() with attacker-controllable input - this specific API data flow is the mandatory precondition, confirmed by both the NVD description and the GHSA advisory. The affected code paths are merge() (which built its accumulator on a pollutable plain object) and the set() helper (which walked untrusted property paths); a payload carrying a __proto__ key is what triggers pollution. LIMITING FACTORS: the vulnerability is inert unless the host app passes untrusted values into configure() (reflected in AC:H), affects only rollbar.js before 2.26.5 and the 3.0.0-alpha1 through 3.0.0-beta4 pre-releases, and the official workaround (sanitizing/avoiding untrusted input to configure()) fully mitigates it without upgrading. No authentication or user interaction is required by the library itself (PR:N/UI:N).

This is a genuine but conditional, moderate-severity issue rather than a top-tier emergency. The signals are internally consistent and point LOW on real-world risk: CVSS 3.1 base is 5.9 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - note AC:H, reflecting that exploitation is not trivial, and C:N/A:N meaning the only base impact is to integrity (prototype pollution). EPSS is low at 0.39% (31st percentile), the CVE is NOT on CISA KEV, and no public exploit was identified, so there is no evidence of active or imminent mass exploitation. The most important nuance the raw CVSS hides: AV:N is technically defensible but misleading as a standalone trigger - exploitation only occurs when the embedding application itself passes attacker-controlled data into rollbar.configure(). In other words, the vulnerable data flow must be built by the consuming app; rollbar.js is not remotely exploitable on its own. There is no SSVC decision data provided. Net: treat as a routine dependency-hygiene patch (bump to 2.26.5 or 3.0.0-beta5), prioritized by whether your code actually forwards untrusted input into rollbar.configure(), not as a drop-everything incident.

An application feeds untrusted data (e.g. values derived from user input, query strings, or a JSON body) into rollbar.configure(). Because merge() previously built its result on a normal object and set() walked attacker-controlled paths, a payload containing a __proto__ key pollutes Object.prototype, injecting properties visible across all objects in the Node.js or browser runtime and potentially altering downstream application logic. No public exploit code was identified, and the high attack complexity (AC:H) reflects that the attacker depends on the host app exposing this exact configure() data flow.