{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-97724 exists.","fix":"No fix has been published for CVE-2026-97724 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-97724 is a medium-severity vulnerability in swmansion React Native Reanimated, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-97724 and fix it if it is affected.\n\nWhat it is: CVE-2026-97724 is a medium-severity vulnerability in swmansion React Native Reanimated, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-97724 exists.\n\nAffected product: swmansion React Native Reanimated. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-97724/ (Markdown: https://insights.sbomify.com/CVE-2026-97724/index.md)","id":"CVE-2026-97724","markdown":"https://insights.sbomify.com/CVE-2026-97724/index.md","name":"CVE-2026-97724","record":{"aliases":["GHSA-5fj2-4frq-gpxm"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"React Native Worklets","requires_auth":"none","summary":"Prototype pollution in React Native Worklets allows attackers to cause application crashes via malicious serialized data, leading to denial of service.","user_interaction":"required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mitre","cpe":[],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/R:U/V:D/RE:L","version":"4.0"},"cwes":[{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes"}],"description":"A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object created during serialization in clonePlainJSObject in packages/react-native-worklets/src/memory/serializable.native.ts. When affected data is subsequently processed by React Native Worklets, the malformed serialized object can cause the React Native application to crash. This can result in a remotely triggered denial of service in applications that pass attacker-controlled data through the affected serialization path. In applications where the attacker-controlled data is persisted, the denial of service may persist across application restarts or repeated attempts to access the affected content.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":false,"headline":"Other in React Native Reanimated","id":"CVE-2026-97724","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"other","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"Path traversal in pfSense CE","id":"CVE-2026-97730"},"packages":[],"prev":{"headline":"madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the chat message rendering functionality.","id":"CVE-2026-97723"},"products":["React Native Reanimated"],"published":"2026-09-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-25","vendors":["swmansion"]},"summary":"Prototype pollution in React Native Worklets allows attackers to cause application crashes via malicious serialized data, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2026-97724/"}