AIKIDO-2026-10675

loopback-datasource-juggler is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Pre-CVE Published Apr 30, 2026

Medium Risk

This Affects:

loopback-datasource-juggler

1.2.13 - 6.0.4

Fixed in 6.0.5

Are you affected? Scan for Free

TL;DR

Affected versions of this package allow unsafe prototype manipulation by directly assigning to __proto__, which can lead to unexpected prototype mutation behavior and increase the risk of prototype pollution or integrity issues in affected objects. An attacker able to influence the object being modified or the surrounding data flow may exploit this behavior to tamper with object inheritance, alter application logic, or trigger unintended property resolution. The issue is fixed by replacing direct __proto__ assignment with Object.setPrototypeOf, which avoids reliance on the legacy accessor and provides a safer, explicit prototype update mechanism.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

loopback-datasource-juggler is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 1.2.13 - 6.0.4.