CVE-2026-29063

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

CVSS 8.7 HIGHEPSS 0.6%CWE-1321

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.7EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

06 mar 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Produtos afetados

immutable-js · immutable-js

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3 https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8 https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5 https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw