@stablelib/cbor CVE-2026-106448

Exploitation requires that the consuming application (1) passes attacker-controlled/untrusted data to @stablelib/cbor's decode() (versions < 2.0.4), and (2) afterward reads values from the decoded object through normal prototype-chain lookup - or merges the decoded object into another object - to drive a security-sensitive decision such as an authorization check, feature flag, or configuration value. The specific trigger is a CBOR map key named '__proto__' (also 'constructor'/'prototype'), which the pre-patch bracket-assignment path routes to the prototype setter. Limiting factors: there is NO impact if the application uses strict own-property checks (Object.hasOwn / hasOwnProperty) and never relies on inherited values for security, or if decoded CBOR never comes from an untrusted source; the flaw is in a library, so the attack requirement (AT:P) depends entirely on this downstream usage pattern rather than on a default service configuration.

The input CVSS 4.0 base score is 8.9 (High) with AV:N/AC:L/AT:P/PR:N/UI:N and an integrity-only impact profile (VC:N, VI:H, and notably SI:H on the subsequent system, VA:N). The AV:N/PR:N/UI:N portion means an attacker needs no privileges or user interaction to deliver a crafted CBOR payload, which raises the raw score, but the AT:P (attack requirement present) metric is the critical qualifier: real impact only materializes when the consuming application both decodes untrusted CBOR and subsequently trusts normal prototype-chain property lookup (or merges the decoded object) for a security decision. No EPSS score, SSVC decision, or KEV entry is present in the supplied data, so exploitation probability and CISA-tracked active-exploitation status cannot be assessed - treat those as unknown rather than low. Working exploit/PoC code is publicly available in the GHSA advisory, so the barrier to weaponization against a vulnerable downstream pattern is low. Overall this is a genuine integrity/logic risk for any service that uses @stablelib/cbor on attacker-supplied input and relies on normal property lookup, but it is not a universally exploitable flaw - its impact is conditional on downstream usage (reflected by AT:P), not on the library itself. One inconsistency: the 'Information Disclosure' tag conflicts with the CVSS confidentiality metric VC:N and the prototype-pollution (integrity) nature of the flaw - verify the tag before treating this as a confidentiality issue.

An application exposes an API or message channel that decodes attacker-supplied CBOR with @stablelib/cbor and later consults the decoded object (e.g. an authorization or feature-flag check) via ordinary property lookup. The attacker submits a CBOR map whose key is '__proto__' with value {isAdmin:true}; the decoder's bracket assignment invokes the prototype setter, so obj.isAdmin resolves to true through the poisoned prototype even though it is not an own property, yielding unauthorized privilege. A complete working PoC is published in the GHSA advisory, lowering the effort to reproduce.