EUVD-2026-42599
GHSA-5727-r6pv-59f5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector retained per CVSS 4.0 source; PR:L because attacker must control question.name input; S:U and C:N/A:N because only limited local integrity impact is demonstrated.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report.
AnalysisAI
Prototype pollution in the enquirer npm package (versions up to 2.4.1) allows remote authenticated attackers to manipulate JavaScript Object.prototype attributes by injecting a crafted value into the question.name argument of the Enquirer.set() function. The vulnerability carries a low CVSS 4.0 score of 2.1, reflecting limited integrity-only impact scoped to the vulnerable system with no confidentiality or availability consequence. Publicly available exploit code exists via GitHub issue #487, though no active exploitation has been confirmed in CISA KEV.
Technical ContextAI
CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) describes prototype pollution - a class of vulnerability endemic to JavaScript and Node.js environments where user-controlled input is used as a property key without sanitization against __proto__, constructor, or prototype. In enquirer (CPE: cpe:2.3:a:n/a:enquirer:*:*:*:*:*:*:*:*), the Enquirer.set() function in the Public Package API processes a question.name argument that can be manipulated to write to the shared Object.prototype chain. Enquirer is a Node.js interactive CLI prompt library widely used in developer tooling and build pipelines. Prototype pollution in such a library can propagate upstream into any Node.js application that trusts properties on Object.prototype, potentially enabling property injection, logic bypass, or privilege escalation depending on how downstream code consumes affected objects.
RemediationAI
No vendor-released patched version has been identified at the time of analysis - the fix status should be monitored via the GitHub issue at https://github.com/enquirer/enquirer/issues/487 and the VulDB entry at https://vuldb.com/vuln/377113. As a compensating control, operators should validate and sanitize all inputs to Enquirer.set() to reject keys containing __proto__, constructor, or prototype before they reach the function. Alternatively, applications consuming enquirer can wrap question.name values with Object.freeze() on the prototype or use a library such as 'safe-flat' to sanitize prototype-polluting payloads at ingestion. Pinning to a version prior to confirmed affected releases (below 2.4.0) may reduce exposure but does not guarantee safety given the wildcard CPE. Developers should monitor the enquirer GitHub repository for a patched release and upgrade immediately upon availability.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today