CVE-2026-104183

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104183
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104183.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104183
Aliases
  • GHSA-mjw6-4jj6-33hc
Published
2026-10-01T20:17:21Z
Modified
2026-10-04T02:30:29Z
Severity
  • 5.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects
Details

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacement instead of creating an own data property. Applications that make authorization or feature decisions from inherited values can therefore consume attacker-controlled properties, and a null prototype can disrupt code that expects Object.prototype methods. The researcher treats parsing untrusted JSON as part of the project contract, while the maintainer states that documented inputs are locally owned dumps, exports, or logs and characterizes the attack vector as local. The global Object.prototype is not polluted. This issue is fixed in version 3.6.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1321"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104183.json"
}
References

Affected packages

Git / github.com/uhop/stream-json

Affected ranges

Type
GIT
Repo
https://github.com/uhop/stream-json
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2f2d35bbb547306991ded6487a279154d865a358
Fixed
77a49460ed92e2f1843fb52305da739e0ef368cc
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "3.6.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.1.0
0.2.0
0.2.1
0.2.2
0.3.0
0.4.1
0.4.2
0.5.0
0.5.1
0.5.2
0.5.3
0.6.0
0.6.1
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.3.3
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.9.0
2.*
2.0.0
2.1.0
3.*
3.0.0
3.1.0
3.2.0
3.3.0
3.4.0
3.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104183.json"