{"answers":{"affected":"2 open source packages ship an affected version, including flat-to-nested.","exploited":"There is no known exploitation of CVE-2026-55091 in the wild and no public exploit code.","fix":"Upgrade flat-to-nested to 1.1.2 or later.","what":"CVE-2026-55091 is a high-severity vulnerability in joaonuno flat-to-nested-js, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-55091 and fix it if it is affected.\n\nWhat it is: CVE-2026-55091 is a high-severity vulnerability in joaonuno flat-to-nested-js, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-55091 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- flat-to-nested (npm): affected all versions; fixed in 1.1.2\n- flat-to-nested (npm): affected all versions; fixed in 1.1.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-55091/ (Markdown: https://insights.sbomify.com/CVE-2026-55091/index.md)","id":"CVE-2026-55091","markdown":"https://insights.sbomify.com/CVE-2026-55091/index.md","name":"CVE-2026-55091","record":{"aliases":["GHSA-hp36-v28f-w3r4"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service","other"],"network_reachable":"yes","non_default_config":false,"product_category":"JavaScript utility library","requires_auth":"none","summary":"Prototype pollution in flat-to-nested allows attackers to corrupt application state or cause denial of service via crafted input.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-915","name":"Improperly Controlled Modification of Dynamically-Determined Object Attributes"},{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes"}],"description":"flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is __proto__, temp[parent] can resolve to Object.prototype, and initPush() can write attacker-controlled data to the global children prototype property while existing prototype methods remain intact. Any application that passes attacker-influenced flat records to convert() can therefore expose unrelated objects to polluted inherited state, causing application-logic corruption or denial of service and potentially enabling greater impact when a downstream prototype-pollution gadget is present. The constructor and prototype strings are also unsafe inherited-key values in the same lookup design. This issue is fixed in version 1.1.2.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key","id":"CVE-2026-55091","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"other","year":"2026"},"n_packages":2,"n_references":3,"next":{"headline":"Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts","id":"CVE-2026-55092"},"packages":[{"ecosystem":"npm","fixed":["1.1.2"],"introduced":["0"],"last_affected":[],"package":"flat-to-nested","purl":null,"source":"GHSA-hp36-v28f-w3r4"},{"ecosystem":"npm","fixed":["1.1.2"],"introduced":["0"],"last_affected":[],"package":"flat-to-nested","purl":"pkg:npm/flat-to-nested","source":"GHSA-hp36-v28f-w3r4"}],"prev":{"headline":"Etherpad: Stored XSS in HTML export via unescaped attribute-pool values","id":"CVE-2026-55090"},"products":["flat-to-nested-js"],"published":"2026-09-14","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-14","vendors":["joaonuno"]},"summary":"Prototype pollution in flat-to-nested allows attackers to corrupt application state or cause denial of service via crafted input.","url":"https://insights.sbomify.com/CVE-2026-55091/"}