Skip to main content

RubyLouvre Avalon CVE-2026-12209

| EUVD-2026-36683 MEDIUM
Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)
2026-06-15 VulDB GHSA-785f-3qgq-ghq3
Prototype Pollution Information Disclosure Avalon
5.5
CVSS 4.0 · Vendor: VulDB
Share

Severity by source

Vendor (VulDB) PRIMARY
5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable, no privileges or interaction required; scope unchanged; integrity-only impact at Low pending independent RCE impact verification.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
CVSS changed
Jun 15, 2026 - 03:22 NVD
6.9 (MEDIUM) 5.5 (MEDIUM)
Analysis Generated
Jun 15, 2026 - 03:15 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in RubyLouvre avalon up to 2.2.10. The impacted element is an unknown function of the file src/filters/index.js of the component Template Filter Handler. Such manipulation leads to improperly controlled modification of object prototype attributes. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Prototype pollution in RubyLouvre Avalon's Template Filter Handler (src/filters/index.js) allows remote unauthenticated attackers to modify JavaScript Object.prototype attributes by supplying crafted template filter input. All versions through 2.2.10 are affected per the CPE range cpe:2.3:a:rubylouvre:avalon:*:*:*:*:*:*:*:*. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send HTTP request with crafted template filter payload
Delivery
Avalon filter handler in src/filters/index.js parses unsanitized property path
Exploit
Attacker-controlled key traverses __proto__ boundary
Execution
Object.prototype mutated with attacker values
Persist
Polluted prototype affects downstream object logic
Impact
Achieve integrity manipulation or RCE via gadget chain
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application passes externally controllable data into an Avalon template filter expression handled by the src/filters/index.js component - specifically, that template rendering is triggered with input the attacker can influence (e.g., a URL parameter, form field, or API payload that feeds into a template). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/E:P) scores 6.9 Medium and indicates network-reachable, zero-authentication exploitation with no attack complexity or prerequisites, but caps impact at low integrity modification. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A remote unauthenticated attacker sends an HTTP request containing a crafted Avalon template expression - such as a filter argument with a key like __proto__[polluted]=true - to an endpoint that server-side or client-side renders Avalon templates with unvalidated input. The filter handler in src/filters/index.js processes the expression without sanitizing prototype-traversing property paths, writing attacker-controlled values into Object.prototype and corrupting the shared prototype chain. …
Remediation No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure, and no fixed version appears in the available references or CPE data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2026-12208 MEDIUM POC
5.5 Jun 15

Prototype pollution in jsonata-js (all versions up to 2.2.0) allows remote unauthenticated attackers to inject arbitrary
CVE-2026-48713 CRITICAL
9.1 Jun 15

Prototype pollution in i18next-fs-backend versions prior to 2.6.6 allows remote attackers to write arbitrary properties

CVE-2026-48714 CRITICAL
9.1 Jun 15

Remote prototype pollution in i18next-http-middleware before 3.9.7 allows unauthenticated attackers to write to Object.p
CVE-2026-53609 CRITICAL
9.1 Jun 12

Prototype pollution in ApostropheCMS versions up to and including 4.30.0 allows an authenticated editor to poison Object
CVE-2026-54312 HIGH
8.5 Jun 16

Denial of service in n8n workflow automation platform versions prior to 2.24.0 allows authenticated users with workflow

Share

CVE-2026-12209 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy