AIKIDO-2025-10708

jquery.datatables is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2020-28458 Published Oct 14, 2025

High Risk

This Affects:

jquery.datatables

0.0.1 - 1.10.15

Fixed in 1.10.23

Are you affected? Scan for Free

TL;DR

This package is vulnerable to prototype pollution in the _fnSetObjectDataFn(...) function, where an attacker could exploit unsanitized property paths by submitting malicious input containing dangerous property names like proto, constructor, or prototype to modify the Object prototype, potentially leading to application behavior manipulation, security control bypass, or denial of service. jquery.datatables is unmaintained and no longer receiving security updates, so it it is recommended to migrate to the datatables.net library version 1.10.23 or later.

Who does this affect?

You are affected if you are using the jquery.datatables package.

Background info

jquery.datatables is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 0.0.1 - 1.10.15.