CVE-2026-55091— flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key
Quick assessment
Affected
joaonuno flat-to-nested-js
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
flat-to-nested 将一个层级结构从扁平表示转换为嵌套表示。在 1.1.2 版本之前，index.js 中的 FlatToNested.prototype.convert 方法将攻击者可影响的 id 和 parent 记录字段直接用作普通 temp 和 pendingChildOf 对象的键。当 parent 或 id 为 时， 可能解析到 ，并且 可以将攻击者控制的数据写入全局的 children 原型属性，同时现有的原型方法保持完好。因此，任何将攻击者影响的扁平记录传递给 convert() 的应用程
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| joaonuno | flat-to-nested-js | < 1.1.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55091
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key
Source: CVE Program / CVE List V5
Vulnerability Description
flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is __proto__, temp[parent] can resolve to Object.prototype, and initPush() can write attacker-controlled data to the global children prototype property while existing prototype methods remain intact. Any application that passes attacker-influenced flat records to convert() can therefore expose unrelated objects to polluted inherited state, causing application-logic corruption or denial of service and potentially enabling greater impact when a downstream prototype-pollution gadget is present. The constructor and prototype strings are also unsafe inherited-key values in the same lookup design. This issue is fixed in version 1.1.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-915
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| joaonuno | flat-to-nested-js | < 1.1.2 | - |
|
II. Public POCs for CVE-2026-55091
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55091
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55091 (1)
Vendor Advisories for CVE-2026-55091 (1)
Vendor Pages for CVE-2026-55091 (1)
IV. Related Vulnerabilities
Same weakness: CWE-915
-
CVE-2026-92217
a2ui-project a2ui Message Parsing message-processor.ts proce -
CVE-2026-72710
SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection -
CVE-2026-85408
Eleveo Quality Management Conversation events dynamically-de -
CVE-2026-84430
gouguoa edit_personal Endpoint Index.php update dynamically- -
CVE-2026-78038
Job argument injection via :args overrides primary_key and t
V. Comments for CVE-2026-55091
No comments yet