Ractive
Monthly
Prototype pollution in ractivejs/ractive through version 1.4.4 allows remote attackers to modify JavaScript Object.prototype attributes via the Ractive#set function's Keypath Handler component. A publicly available proof-of-concept exists (GitHub issue #3448), and the maintainers have not yet responded to the coordinated disclosure. No vendor-released patch is available at time of analysis, leaving all users of the 1.4.x branch exposed with no official remediation path.
Prototype pollution in ractivejs/ractive through version 1.4.4 allows remote attackers to modify JavaScript Object.prototype attributes via the Ractive#set function's Keypath Handler component. A publicly available proof-of-concept exists (GitHub issue #3448), and the maintainers have not yet responded to the coordinated disclosure. No vendor-released patch is available at time of analysis, leaving all users of the 1.4.x branch exposed with no official remediation path.