stream-json CVE-2026-104183

Exploitation requires that the application (1) feed attacker-influenceable JSON into stream-json's Assembler or FlexAssembler (versions < 3.6.0), and (2) subsequently make authorization, feature, or control-flow decisions by reading object properties through prototype inheritance, OR rely on Object.prototype methods on the parsed object (which a null-prototype payload breaks). The specific trigger is an input key literally named __proto__, which pre-patch is set via plain assignment and invokes the inherited setter. Limiting factors: impact is confined to the individual parsed object (global Object.prototype is not affected); the maintainer's documented/supported use is local, trusted files (dumps, exports, logs), so reaching the parser with hostile input requires a deployment that violates that intended-input contract; no user interaction or authentication to the library itself is needed once malicious JSON reaches it.

This is a genuine but modest-severity flaw whose real-world risk hinges entirely on a disputed threat model. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, 5.1 Medium) is internally consistent with the maintainer's position: AV:L reflects their characterization of the attack vector as local, since documented inputs are owned dumps, exports, and logs rather than internet-facing data. The researcher, however, treats parsing untrusted JSON as part of the project contract - if that view holds, the vector would be remote (AV:N) and risk would be higher. This is a direct conflict between vendor and reporter that defenders must resolve for their own deployment: CVSS AV:L implies local access, but the technical mechanism works identically on any untrusted JSON regardless of source. There is no KEV listing and no POC or EPSS score in the supplied data, so there is no evidence of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis.' Importantly, impact is bounded: the global Object.prototype is NOT polluted; only the parsed object's own prototype is replaced, so this is object-scoped prototype replacement rather than classic application-wide prototype pollution. Priority is therefore moderate: patch as routine hygiene, elevate only if your application feeds externally-sourced JSON into Assembler/FlexAssembler and makes authorization or feature decisions from inherited object values.

An application uses stream-json's Assembler to parse JSON that an attacker can influence (e.g., an uploaded export or a log record), and later makes an authorization or feature-flag decision by reading a property via prototype inheritance. The attacker supplies a key named __proto__ whose value replaces the parsed object's prototype, so the application reads attacker-controlled inherited values or, with a null prototype, crashes when calling Object.prototype methods. No public exploit code is identified, and under the supplied CVSS the vector is local (AV:L), limiting reach to data the attacker can route into locally-processed files.