{"id":"CVE-2026-33863","aliases":["GHSA-hf2r-9gf9-rwch"],"status":"published","title":"Convict has prototype pollution via load(), loadFile(), and schema initialization","description":"### Impact\nTwo unguarded prototype pollution paths exist, not covered by previous fixes:\n\n1. `config.load()` / `config.loadFile()` — `overlay()` recursively merges config data without checking for forbidden keys. Input containing` __proto__` or `constructor.prototype` (e.g. from a JSON file) causes the recursion to reach `Object.prototype` and write attacker-controlled values onto it.\n2. Schema initialization — passing a schema with `constructor.prototype.*` keys to `convict({...})` causes default-value propagation to write directly to `Object.prototype` at startup.\n\nDepending on how polluted properties are consumed, impact ranges from unexpected behavior to authentication bypass or RCE.\n\n### Workarounds\nDo not pass untrusted data to load(), loadFile(), or convict().\n\n### Resources\nPrior advisory: [GHSA-44fc-8fm5-q62h](https://github.com/mozilla/node-convict/security/advisories/GHSA-44fc-8fm5-q62h)\nRelated issue: [https://github.com/mozilla/node-convict/issues/423](https://github.com/mozilla/node-convict/issues/423)","severity":{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2026-03-26T18:50:33Z","modified":"2026-03-26T19:11:25Z","fixes":[{"ecosystem":"npm","package":"convict","fixed_in":["6.2.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"convict","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.2.4"},{"fixed":"6.2.5"}]}]},{"source":"osv","ecosystem":"npm","package":"convict","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.2.5"}]}]}],"references":[{"url":"https://github.com/mozilla/node-convict/security/advisories/GHSA-44fc-8fm5-q62h","tags":["web"]},{"url":"https://github.com/mozilla/node-convict/security/advisories/GHSA-hf2r-9gf9-rwch","tags":["web"]},{"url":"https://github.com/mozilla/node-convict/issues/423","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hf2r-9gf9-rwch"},{"url":"https://github.com/mozilla/node-convict","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-hf2r-9gf9-rwch","title":"Convict has prototype pollution via load(), loadFile(), and schema initialization","description":"### Impact\nTwo unguarded prototype pollution paths exist, not covered by previous fixes:\n\n1. `config.load()` / `config.loadFile()` — `overlay()` recursively merges config data without checking for forbidden keys. Input containing` __proto__` or `constructor.prototype` (e.g. from a JSON file) causes the recursion to reach `Object.prototype` and write attacker-controlled values onto it.\n2. Schema initialization — passing a schema with `constructor.prototype.*` keys to `convict({...})` causes default-value propagation to write directly to `Object.prototype` at startup.\n\nDepending on how polluted properties are consumed, impact ranges from unexpected behavior to authentication bypass or RCE.\n\n### Workarounds\nDo not pass untrusted data to load(), loadFile(), or convict().\n\n### Resources\nPrior advisory: [GHSA-44fc-8fm5-q62h](https://github.com/mozilla/node-convict/security/advisories/GHSA-44fc-8fm5-q62h)\nRelated issue: [https://github.com/mozilla/node-convict/issues/423](https://github.com/mozilla/node-convict/issues/423)","status":"published","published":"2026-03-26T18:50:33Z","modified":"2026-03-26T18:50:36Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:39:43.747579Z"}],"osv":[{"id":"GHSA-hf2r-9gf9-rwch","title":"Convict has prototype pollution via load(), loadFile(), and schema initialization","description":"### Impact\nTwo unguarded prototype pollution paths exist, not covered by previous fixes:\n\n1. `config.load()` / `config.loadFile()` — `overlay()` recursively merges config data without checking for forbidden keys. Input containing` __proto__` or `constructor.prototype` (e.g. from a JSON file) causes the recursion to reach `Object.prototype` and write attacker-controlled values onto it.\n2. Schema initialization — passing a schema with `constructor.prototype.*` keys to `convict({...})` causes default-value propagation to write directly to `Object.prototype` at startup.\n\nDepending on how polluted properties are consumed, impact ranges from unexpected behavior to authentication bypass or RCE.\n\n### Workarounds\nDo not pass untrusted data to load(), loadFile(), or convict().\n\n### Resources\nPrior advisory: [GHSA-44fc-8fm5-q62h](https://github.com/mozilla/node-convict/security/advisories/GHSA-44fc-8fm5-q62h)\nRelated issue: [https://github.com/mozilla/node-convict/issues/423](https://github.com/mozilla/node-convict/issues/423)","status":"published","published":"2026-03-26T18:50:33Z","modified":"2026-03-26T19:11:25.577317Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:48.920784Z"}]}}