Elysia CVE-2025-66456

Requires an Elysia application (v1.4.0-1.4.16) that defines a standalone guard (schema: 'standalone') whose body schema includes an any-typed field, so that during mergeDeep of two standard-schema validation results with the same key the merge ordering permits a __proto__ property to be merged into the prototype. For the full RCE chain, the app must additionally meet the GHSA-8vch-m3f4-q8jf conditions: AOT compilation enabled (the default), a cookie schema attached to a route, and an attacker-influenceable cookie config (e.g., cookie secrets provisioned via environment). Limiting factors: the standalone-guard-plus-any-type pattern is a non-default, application-specific configuration, and standalone prototype pollution only escalates to code execution when the cookie-config injection prerequisites are also present; without them impact is confined to prototype pollution.

The CVSS 4.0 base score of 9.1 (Critical) reflects a network-reachable, unauthenticated flaw (AV:N/PR:N/UI:N) with high confidentiality and integrity impact, but the AT:P metric correctly signals that exploitation is NOT unconditional - a specific attack requirement must be met. That requirement is confirmed by both the description and the commit diff: the Elysia app must use a standalone guard whose body schema contains an any type, so that merge ordering in mergeDeep lets a __proto__ property survive. On its own this is a CWE-1321 prototype pollution issue; it only becomes full RCE when chained with GHSA-8vch-m3f4-q8jf (unsanitized cookie-config injection). The real-world signals temper the headline severity: EPSS is only 0.56% (45th percentile) and there is no CISA KEV listing, so there is no evidence of active widespread exploitation despite publicly available exploit code. The vendor's own advisory explicitly states exploit availability is 'generally low' because the RCE half of the chain requires write access to the cookie config. Net assessment: a genuinely serious flaw in affected deployments that use the specific standalone-guard-with-any pattern, but the non-default configuration prerequisite and low EPSS make it a lower practical priority than the Critical score alone implies - prioritize patching for apps matching the vulnerable pattern rather than treating it as mass-exploitable.

An attacker sends a crafted HTTP request whose JSON body includes a __proto__ property to an Elysia endpoint whose route is protected by a standalone guard containing an any-typed body schema. During mergeDeep of the two standard-schema validation results, the __proto__ key is merged into Object.prototype; when combined with the cookie-config injection flaw (GHSA-8vch-m3f4-q8jf, which has a public POC at github.com/sportshead/elysia-poc), this yields arbitrary code execution on the server. Publicly available exploit code exists for this chain, though the required non-default configuration limits its reach.