{"id":"EUVD-2026-93973","enisaUuid":"18452ace-ab71-3889-aa29-0de1efd8be2a","description":"StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named __proto__ invokes the inherited prototype setter instead of creating an ordinary own property, allowing the decoded object\u0027s prototype to contain attacker-controlled authorization or feature-flag values. Downstream code that trusts normal property lookup or merges the decoded object can therefore make security-sensitive decisions using inherited attacker data. This issue is fixed in version 2.0.4.","datePublished":"Oct 6, 2026, 7:45:02 PM","dateUpdated":"Oct 7, 2026, 5:07:38 PM","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","references":"https://github.com/StableLib/stablelib/security/advisories/GHSA-w48f-fwg7-ww6p\nhttps://github.com/StableLib/stablelib/commit/0f153a63b7552a0e8721f640984113e419015026\nhttps://github.com/StableLib/stablelib/releases/tag/@stablelib/cbor@2.0.4\n","aliases":"CVE-2026-106448\n","assigner":"GitHub_M","epss":0.4,"enisaIdProduct":[{"id":"04920356-be4e-3a44-af7f-206d7abb084a","product":{"name":"stablelib","vendor":{"name":"StableLib"}},"product_version":"\u003c 2.0.4"}],"enisaIdVendor":[{"id":"51003545-10c3-33cd-a207-2e7aae04e696","vendor":{"name":"StableLib"}}],"enisaIdVulnerability":[{"id":"7ccaa2bf-0f5c-373b-945f-e4d53939191a","vulnerability":{"id":"CVE-2026-106448","description":"StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named __proto__ invokes the inherited prototype setter instead of creating an ordinary own property, allowing the decoded object\u0027s prototype to contain attacker-controlled authorization or feature-flag values. Downstream code that trusts normal property lookup or merges the decoded object can therefore make security-sensitive decisions using inherited attacker data. This issue is fixed in version 2.0.4.","datePublished":"Oct 6, 2026, 7:45:02 PM","dateUpdated":"Oct 7, 2026, 5:07:38 PM","status":"PUBLISHED","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","references":"https://github.com/StableLib/stablelib/security/advisories/GHSA-w48f-fwg7-ww6p\nhttps://github.com/StableLib/stablelib/commit/0f153a63b7552a0e8721f640984113e419015026\nhttps://github.com/StableLib/stablelib/releases/tag/@stablelib/cbor@2.0.4\n","enisa_id":"EUVD-2026-93973\n","assigner":"GitHub_M","epss":0.4,"dataProcessed":"Nov 11, 2026, 7:21:43 AM","vulnerabilityProduct":[{"id":"7d42b658-8efb-3065-8bee-3245f71ed4ff","product":{"name":"stablelib","vendor":{"name":"StableLib"}},"product_version":"\u003c 2.0.4"}],"vulnerabilityVendor":[{"id":"be53da83-04a6-3ba1-b6b5-4fe8f6d26eed","vendor":{"name":"StableLib"}}]}}],"enisaIdAdvisory":[]}