Joi
Monthly
Prototype pollution in joi, one of the most widely used JavaScript schema-validation libraries (versions 16.0.0 through <17.13.6 and <18.2.5, and @hapi/joi through 17.1.1), allows an attacker who can supply attacker-controlled language keys to joi's schema-construction message API to write arbitrary properties onto Object.prototype or the Object constructor's static properties. A language key named __proto__ contaminates the global prototype, causing every subsequent property-existence check on any plain object in the process to return an unexpected value, silently flipping conditional logic. No public exploit has been identified at time of analysis, exploitation conditions are restrictive, and the vendor has released fixed versions 17.13.6 and 18.2.5.
Limited prototype pollution in joi's object().rename() allows unauthenticated remote attackers to set the prototype of the object returned by validate(), but does not affect global Object.prototype. When a schema combines a regex rename source, a Joi.x() or Joi.expression() interpolating template target, and { multiple: true }, an input key such as x-__proto__ causes the rename target to resolve to __proto__, which JavaScript interprets as a prototype assignment rather than own-property creation. The scope is strictly confined to the single validation call result - downstream code that reads prototype-inherited properties on that object could observe attacker-injected values, enabling potential within-request privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; CVSS 3.7 (AC:H) accurately reflects the tight, non-default schema configuration required.
Prototype pollution in joi, one of the most widely used JavaScript schema-validation libraries (versions 16.0.0 through <17.13.6 and <18.2.5, and @hapi/joi through 17.1.1), allows an attacker who can supply attacker-controlled language keys to joi's schema-construction message API to write arbitrary properties onto Object.prototype or the Object constructor's static properties. A language key named __proto__ contaminates the global prototype, causing every subsequent property-existence check on any plain object in the process to return an unexpected value, silently flipping conditional logic. No public exploit has been identified at time of analysis, exploitation conditions are restrictive, and the vendor has released fixed versions 17.13.6 and 18.2.5.
Limited prototype pollution in joi's object().rename() allows unauthenticated remote attackers to set the prototype of the object returned by validate(), but does not affect global Object.prototype. When a schema combines a regex rename source, a Joi.x() or Joi.expression() interpolating template target, and { multiple: true }, an input key such as x-__proto__ causes the rename target to resolve to __proto__, which JavaScript interprets as a prototype assignment rather than own-property creation. The scope is strictly confined to the single validation call result - downstream code that reads prototype-inherited properties on that object could observe attacker-injected values, enabling potential within-request privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; CVSS 3.7 (AC:H) accurately reflects the tight, non-default schema configuration required.