CVE-2026-73088 Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
Attackers can cause crashes or modify object prototypes via untrusted stats data in Browserslist, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73088?
CVE-2026-73088 is a high-severity code injection vulnerability in browserslist, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.
Which versions are affected by CVE-2026-73088?
2 open source packages ship an affected version, including browserslist.
| Package | Affected | Fixed in |
|---|---|---|
browserslist npm | All versions | 4.28.7 |
browserslist npm | All versions | 4.28.7 |
Linux distribution packages (2)
bun openSUSE:Tumbleweed | All versions | 1.4.0~git20260808.52bf09cb-2.1 |
python-pytest-html openSUSE:Tumbleweed | All versions | 4.2.0-5.1 |
How do I fix CVE-2026-73088?
Upgrade browserslist to 4.28.7 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-73088 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73088 exists.
Sources
Also known as CLEANSTART-2026-BT23660, CLEANSTART-2026-DU94762, CLEANSTART-2026-HE25090, CLSA-2026-1790004614, CLSA-2026-1790016470, CLSA-2026-1790541831 and 26 more.