Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (1)
| Vulnerability |
Summary |
Aliases |
|
VCID-4wjr-2u8x-dbdg
|
Elysia vulnerable to prototype pollution with multiple standalone schema validation
Prototype pollution vulnerability in `mergeDeep` after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must be an `any` type that is set as a `standalone` guard, to allow for the `__proto__` prop to be merged.
When combined with GHSA-8vch-m3f4-q8jf this allows for a full RCE by an attacker.
|
CVE-2025-66456
GHSA-hxj9-33pp-j2cc
|