Vulnerability in yayson (CVE-2026-61534)
Summary
Vulnerability in yayson (CVE-2026-61534). Data can be tampered with by attackers. Exploitable via Store. Mitigation: upgrade to 4.3.0 or later.
Original description
The description as published by the source.
Summary
Store/LegacyStore key internal lookup tables by the type, id, and relationship names from a JSON:API document. Because these were plain objects, a document with type: "__proto__" writes onto Object.prototype, polluting every object in the process.
Severity
Suggested CVSS v3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (8.1). The guaranteed impact is process-wide DoS / logic corruption; escalation to authorization bypass or RCE is dependent on gadgets in the consuming application.
Affected / Patched
- Affected:
<= 4.2.0(verified in3.0.0and4.2.0; all 3.x and 4.x). - Patched:
4.3.0.
Details
type is a string value, untouched by JSON.parse, and is used directly as an object key:
if (!models[type]) models[type] = {} // models["__proto__"] is Object.prototype → skipped
if (!models[type][id]) models[type][id] = model // → Object.prototype[id] = model
The attacker controls the polluted key (id) and value (the model, populated from attributes). Pollution persists for the process lifetime. The malicious type can also arrive via an included resource referenced by a relationship, bypassing any data.type allow-list. LegacyStore is additionally reachable when a configured types mapping resolves to "__proto__".
Proof of concept
const { Store } = require('yayson')()
new Store().sync({ data: { type: '__proto__', id: 'polluted', attributes: { x: 1 } } })
console.log(({}).polluted) // { x: 1, id: 'polluted' }…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-61534 has been found in yayson.
Attackers can target a specific entry point like Store over the network to misuse the product.
Data can be tampered with by attackers. CVSS score: 9.1/10.
What to do: upgrade yayson to 4.3.0 or later.
If unsure, ask your IT team or search "yayson CVE-2026-61534" on the vendor's site.
CVE-2026-61534 (yayson) — CWE-1321 / CVSS v3 9.1
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: Store / LegacyStore / type / Object.prototype
Patched: 4.3.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-1321) exists in yayson. Attackers reach the vulnerable code path via Store without authentication.
Check the vendor advisory for the affected versions of yayson. Attack surface: Store / LegacyStore / type / Object.prototype.
Severity: Critical (CVSS 9.1/10). Data can be tampered with by attackers.
Update to 4.3.0.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'yayson' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'yayson' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
yaysonを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade yayson to 4.3.0ステージング環境で 4.3.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。