{"id":"GHSA-xcg2-9pp4-j82x","revision":"d3ec04a23c0d4f7b9ec2eac1bdaf14e9","records":[{"revision":"d3ec04a23c0d4f7b9ec2eac1bdaf14e9","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-xcg2-9pp4-j82x","aliases":["CVE-2025-62517"],"title":"rollbar vulnerable to Prototype Pollution in merge()","description":"### Impact\n\nPrototype pollution vulnerability in merge(). If application code calls `rollbar.configure()` with untrusted input, prototype pollution is possible.\n\n### Patches\n\nFixed in 2.26.5 and 3.0.0-beta5.\n\n### Workarounds\n\nEnsure that values passed to `rollbar.configure()` do not contain untrusted input.\n\n### References\n\nFixed in https://github.com/rollbar/rollbar.js/pull/1394 (2.26.x) and https://github.com/rollbar/rollbar.js/pull/1390 (3.x)","state":0,"publishedAt":"2025-10-23T20:31:30+00:00","modifiedAt":"2025-10-24T19:28:46+00:00","affected":[{"ecosystem":"npm","name":"rollbar","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.26.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"rollbar","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0-alpha1"},{"kind":"fixed","version":"3.0.0-beta5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/rollbar/rollbar.js/security/advisories/GHSA-xcg2-9pp4-j82x","https://nvd.nist.gov/vuln/detail/CVE-2025-62517","https://github.com/rollbar/rollbar.js/pull/1390","https://github.com/rollbar/rollbar.js/pull/1394","https://github.com/rollbar/rollbar.js/commit/61032fe6c208b71e249514800808a54bcb8cb8bb","https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343","https://github.com/rollbar/rollbar.js"],"sourceUrl":"https://github.com/advisories/GHSA-xcg2-9pp4-j82x","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-xcg2-9pp4-j82x","identifiers":["GHSA-xcg2-9pp4-j82x","CVE-2025-62517"]},"retained":false,"historicalAffected":[]}],"coverage":[]}