joi EUVD-2026-69649

Exploitation requires an application to pass attacker-controlled values directly into joi's schema-construction message configuration as language keys - specifically via messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). This is an explicitly non-default pattern: joi's standard usage is to build schemas from static developer-written code and validate untrusted data through those schemas; the vulnerability is not reachable from the validated data path itself. Only applications implementing dynamic, externally configurable locale or message-key support that route external input into schema construction are exploitable. Further limiting exploitation: the incorrect branch outcome depends on downstream application code performing property-existence checks on plain objects, making weaponization application-logic-dependent rather than directly exploitable in all contexts.

The CVSS base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) is well-calibrated for this vulnerability. High complexity is warranted because exploitation requires an application to actively route untrusted user input into joi's schema-construction message configuration rather than through its normal data validation path - a pattern explicitly noted as non-default in the advisory. No KEV listing exists, no public exploit has been identified at time of analysis, and EPSS data was not provided but would be expected to be low given the restrictive application-level precondition. Real-world risk is bounded: the overwhelming majority of joi consumers build schemas from static, developer-controlled source code and never expose message configuration keys to external input. Applications with dynamic, user-configurable locale support that route externally supplied keys into joi's message APIs represent the realistic at-risk population. The I:L impact is meaningful - prototype pollution can silently flip authorization or conditional logic for any property-existence check in the process - but is not arbitrary code execution and requires an application-specific code path to be weaponized.

An attacker controlling user-supplied locale keys in a multi-language web application submits a key named __proto__ with a nested property such as isAdmin: true through a language preference or message customization endpoint. If the application routes this key into a joi schema's messages() or Joi.extend({ messages }) call without sanitization, exports.compile() writes isAdmin: true onto Object.prototype. All subsequent checks of the form if (obj.isAdmin) anywhere in the process then evaluate to true for every plain object, potentially bypassing authorization gates. No public exploit code has been identified at time of analysis.