Search for packages
| purl | pkg:npm/rollbar@2.26.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-fj2p-16vc-8fc6 | rollbar vulnerable to Prototype Pollution in merge() Prototype pollution vulnerability in merge(). If application code calls `rollbar.configure()` with untrusted input, prototype pollution is possible. |
CVE-2025-62517
GHSA-xcg2-9pp4-j82x |
| VCID-hejw-1yqn-r3fj | rollbar vulnerable to prototype pollution Prototype pollution potential with the utility function `rollbar/src/utility`.`set()`. No impact when using the published public interface. If application code directly imports `set` from `rollbar/src/utility` and then calls `set` with untrusted input in the second argument, it is vulnerable to prototype pollution. POC: ```js const obj = {}; require("rollbar/src/utility").set(obj, "__proto__.polluted", "vulnerable"); console.log({}.polluted !== undefined ? '[POLLUTION_TRIGGERED]':''); ``` |
CVE-2025-57325
GHSA-r8c2-2qwq-94p6 |