Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Affecting grist package, versions <1.7.17-r0
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-MINIMOSLATEST-GRIST-17690439
- published30 Jun 2026
- disclosed15 Jun 2026
Introduced: 15 Jun 2026
CVE-2026-48714 (opens in a new tab)How to fix?
Upgrade Minimos:latest grist to version 1.7.17-r0 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream grist package and not the grist package as distributed by Minimos.
See How to fix? for Minimos:latest relevant fixed versions and status.
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys proto, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as "proto.polluted". Downstream backends that split the missing-key string on a configured keySeparator (notably i18next-fs-backend ≤ 2.6.5) hand these keys to an unguarded setPath() walker that writes to Object.prototype. Applications that expose missingKeyHandler to untrusted input AND use i18next-fs-backend ≤ 2.6.5 are directly exploitable for remote prototype pollution. Other downstream backends that split the missing-key string the same way may be similarly affected. Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks. This issue has been fixed in version 3.9.7. If developers cannot upgrade immediately, they should do the following: do not expose missingKeyHandler to untrusted users (mount it behind authentication, or remove the route), add a request-body filter ahead of the handler that rejects any top-level key containing proto, constructor, or prototype after splitting on their configured keySeparator, and disable missing-key persistence (saveMissing: false) when accepting writes from untrusted input.
References
- https://www.cve.org/CVERecord?id=CVE-2026-48714
- https://github.com/advisories/GHSA-f49m-vf83-692w
- https://osv.dev/vulnerability/MINI-vwr9-jcqh-qvcf
- https://osv.dev/vulnerability/CVE-2026-48714
- https://github.com/i18next/i18next-http-middleware/commit/7c6d26f137d3e940b8d229ca148bca38845faf49
- https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-f49m-vf83-692w