{"id":"CVE-2026-106448","summary":"StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding","details":"StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named __proto__ invokes the inherited prototype setter instead of creating an ordinary own property, allowing the decoded object's prototype to contain attacker-controlled authorization or feature-flag values. Downstream code that trusts normal property lookup or merges the decoded object can therefore make security-sensitive decisions using inherited attacker data. This issue is fixed in version 2.0.4.","aliases":["GHSA-w48f-fwg7-ww6p"],"modified":"2026-10-08T02:51:18.173023719Z","published":"2026-10-06T19:45:02.616Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106448.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-1321"]},"references":[{"type":"WEB","url":"https://github.com/StableLib/stablelib/releases/tag/@stablelib/cbor@2.0.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106448.json"},{"type":"ADVISORY","url":"https://github.com/StableLib/stablelib/security/advisories/GHSA-w48f-fwg7-ww6p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106448"},{"type":"FIX","url":"https://github.com/StableLib/stablelib/commit/0f153a63b7552a0e8721f640984113e419015026"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/stablelib/stablelib","events":[{"introduced":"0"},{"fixed":"0f153a63b7552a0e8721f640984113e419015026"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.0.4"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["@stablelib/ed25519@2.1.0","@stablelib/utf8@2.1.0","@stablelib/snappy@2.0.2","@stablelib/scrypt@2.0.2","@stablelib/cbor@2.0.2","@stablelib/xsalsa20@2.0.1","@stablelib/xchacha20poly1305@2.0.1","@stablelib/xchacha20@2.0.1","@stablelib/x25519@2.0.1","@stablelib/x25519-session@2.0.1","@stablelib/wipe@2.0.1","@stablelib/uuid@2.0.1","@stablelib/utf8@2.0.1","@stablelib/tss@2.0.1","@stablelib/snappy@2.0.1","@stablelib/siv@2.0.1","@stablelib/sha512_256@2.0.1","@stablelib/sha512@2.0.1","@stablelib/sha3@2.0.1","@stablelib/sha384@2.0.1","@stablelib/sha256@2.0.1","@stablelib/sha224@2.0.1","@stablelib/scrypt@2.0.1","@stablelib/salsa20@2.0.1","@stablelib/random@2.0.1","@stablelib/poly1305@2.0.1","@stablelib/pbkdf2@2.0.1","@stablelib/newhope@2.0.1","@stablelib/nacl@2.0.1","@stablelib/keyagreement@2.0.1","@stablelib/int@2.0.1","@stablelib/hmac@2.0.1","@stablelib/hmac-drbg@2.0.1","@stablelib/hkdf@2.0.1","@stablelib/hex@2.0.1","@stablelib/halfsiphash@2.0.1","@stablelib/gf256@2.0.1","@stablelib/gcm@2.0.1","@stablelib/float@2.0.1","@stablelib/ed25519@2.0.2","@stablelib/ctr@2.0.1","@stablelib/constant-time@2.0.1","@stablelib/cmac@2.0.1","@stablelib/chacha@2.0.1","@stablelib/chacha20poly1305@2.0.1","@stablelib/chacha-drbg@2.0.1","@stablelib/cbor@2.0.1","@stablelib/bytewriter@2.0.1","@stablelib/bytes@2.0.1","@stablelib/bytereader@2.0.1","@stablelib/blake2xs@2.0.1","@stablelib/blake2s@2.0.1","@stablelib/blake2b@2.0.1","@stablelib/binary@2.0.1","@stablelib/base64@2.0.1","@stablelib/aes@2.0.1","@stablelib/aes-kw@2.0.1","@stablelib/ed25519@2.0.1","v2.0.0","@stablelib/xsalsa20@2.0.0","@stablelib/xchacha20poly1305@2.0.0","@stablelib/xchacha20@2.0.0","@stablelib/x25519@2.0.0","@stablelib/x25519-session@2.0.0","@stablelib/wipe@2.0.0","@stablelib/uuid@2.0.0","@stablelib/utf8@2.0.0","@stablelib/tss@2.0.0","@stablelib/snappy@2.0.0","@stablelib/siv@2.0.0","@stablelib/sha512_256@2.0.0","@stablelib/sha512@2.0.0","@stablelib/sha3@2.0.0","@stablelib/sha384@2.0.0","@stablelib/sha256@2.0.0","@stablelib/sha224@2.0.0","@stablelib/scrypt@2.0.0","@stablelib/salsa20@2.0.0","@stablelib/random@2.0.0","@stablelib/poly1305@2.0.0","@stablelib/pbkdf2@2.0.0","@stablelib/newhope@2.0.0","@stablelib/nacl@2.0.0","@stablelib/keyagreement@2.0.0","@stablelib/int@2.0.0","@stablelib/hmac@2.0.0","@stablelib/hmac-drbg@2.0.0","@stablelib/hkdf@2.0.0","@stablelib/hex@2.0.0","@stablelib/hash@2.0.0","@stablelib/halfsiphash@2.0.0","@stablelib/gf256@2.0.0","@stablelib/gcm@2.0.0","@stablelib/float@2.0.0","@stablelib/ed25519@2.0.0","@stablelib/ctr@2.0.0","@stablelib/constant-time@2.0.0","@stablelib/cmac@2.0.0","@stablelib/chacha@2.0.0","@stablelib/chacha20poly1305@2.0.0","@stablelib/chacha-drbg@2.0.0","@stablelib/cbor@2.0.0","@stablelib/bytewriter@2.0.0","@stablelib/bytes@2.0.0","@stablelib/bytereader@2.0.0","@stablelib/blockcipher@2.0.0","@stablelib/blake2xs@2.0.0","@stablelib/blake2s@2.0.0","@stablelib/blake2b@2.0.0","@stablelib/binary@2.0.0","@stablelib/benchmark@2.0.0","@stablelib/base64@2.0.0","@stablelib/aes@2.0.0","@stablelib/aes-kw@2.0.0","@stablelib/aead@2.0.0","@stablelib/utf8@1.0.2","@stablelib/snappy@1.0.3","@stablelib/scrypt@1.0.3","@stablelib/cbor@1.0.2","@stablelib/x25519-session@1.0.4","@stablelib/x25519@1.0.3","@stablelib/uuid@1.0.2","@stablelib/tss@1.0.2","@stablelib/snappy@1.0.2","@stablelib/siv@1.0.2","@stablelib/scrypt@1.0.2","@stablelib/random@1.0.2","@stablelib/newhope@1.0.2","@stablelib/nacl@1.0.4","@stablelib/hmac-drbg@1.0.2","@stablelib/gcm@1.0.2","@stablelib/ed25519@1.0.3","@stablelib/ctr@1.0.2","@stablelib/chacha-drbg@1.0.3","@stablelib/x25519@1.0.2","@stablelib/nacl@1.0.3","@stablelib/chacha-drbg@1.0.2","@stablelib/xsalsa20@1.0.2","@stablelib/xchacha20poly1305@1.0.1","@stablelib/xchacha20@1.0.1","@stablelib/x25519@1.0.1","@stablelib/wipe@1.0.1","@stablelib/uuid@1.0.1","@stablelib/utf8@1.0.1","@stablelib/tss@1.0.1","@stablelib/snappy@1.0.1","@stablelib/siv@1.0.1","@stablelib/sha512_256@1.0.1","@stablelib/sha512@1.0.1","@stablelib/sha3@1.0.1","@stablelib/sha384@1.0.1","@stablelib/sha256@1.0.1","@stablelib/sha224@1.0.1","@stablelib/scrypt@1.0.1","@stablelib/salsa20@1.0.2","@stablelib/random@1.0.1","@stablelib/poly1305@1.0.1","@stablelib/pbkdf2@1.0.1","@stablelib/newhope@1.0.1","@stablelib/nacl@1.0.2","@stablelib/keyagreement@1.0.1","@stablelib/int@1.0.1","@stablelib/hmac@1.0.1","@stablelib/hmac-drbg@1.0.1","@stablelib/hkdf@1.0.1","@stablelib/hex@1.0.1","@stablelib/hash@1.0.1","@stablelib/halfsiphash@1.0.1","@stablelib/gf256@1.0.1","@stablelib/gcm@1.0.1","@stablelib/float@1.0.1","@stablelib/ed25519@1.0.2","@stablelib/ctr@1.0.1","@stablelib/constant-time@1.0.1","@stablelib/cmac@1.0.1","@stablelib/chacha@1.0.1","@stablelib/chacha20poly1305@1.0.1","@stablelib/chacha-drbg@1.0.1","@stablelib/cbor@1.0.1","@stablelib/bytewriter@1.0.1","@stablelib/bytes@1.0.1","@stablelib/bytereader@1.0.1","@stablelib/blockcipher@1.0.1","@stablelib/blake2xs@1.0.1","@stablelib/blake2s@1.0.1","@stablelib/blake2b@1.0.1","@stablelib/binary@1.0.1","@stablelib/benchmark@1.0.1","@stablelib/base64@1.0.1","@stablelib/aes@1.0.1","@stablelib/aes-kw@1.0.1","@stablelib/aead@1.0.1","@stablelib/xsalsa20@1.0.1","@stablelib/salsa20@1.0.1","@stablelib/nacl@1.0.1","@stablelib/aes-kw@1.0.0","@stablelib/ed25519@1.0.1","@stablelib/xsalsa20@1.0.0","@stablelib/xchacha20poly1305@1.0.0","@stablelib/xchacha20@1.0.0","@stablelib/x25519@1.0.0","@stablelib/wipe@1.0.0","@stablelib/uuid@1.0.0","@stablelib/utf8@1.0.0","@stablelib/tss@1.0.0","@stablelib/snappy@1.0.0","@stablelib/siv@1.0.0","@stablelib/sha512_256@1.0.0","@stablelib/sha512@1.0.0","@stablelib/sha3@1.0.0","@stablelib/sha384@1.0.0","@stablelib/sha256@1.0.0","@stablelib/sha224@1.0.0","@stablelib/scrypt@1.0.0","@stablelib/salsa20@1.0.0","@stablelib/random@1.0.0","@stablelib/poly1305@1.0.0","@stablelib/pbkdf2@1.0.0","@stablelib/newhope@1.0.0","@stablelib/nacl@1.0.0","@stablelib/keyagreement@1.0.0","@stablelib/int@1.0.0","@stablelib/hmac@1.0.0","@stablelib/hmac-drbg@1.0.0","@stablelib/hkdf@1.0.0","@stablelib/hex@1.0.0","@stablelib/hash@1.0.0","@stablelib/halfsiphash@1.0.0","@stablelib/gf256@1.0.0","@stablelib/gcm@1.0.0","@stablelib/float@1.0.0","@stablelib/ed25519@1.0.0","@stablelib/ctr@1.0.0","@stablelib/constant-time@1.0.0","@stablelib/cmac@1.0.0","@stablelib/chacha@1.0.0","@stablelib/chacha20poly1305@1.0.0","@stablelib/chacha-drbg@1.0.0","@stablelib/cbor@1.0.0","@stablelib/bytewriter@1.0.0","@stablelib/bytes@1.0.0","@stablelib/bytereader@1.0.0","@stablelib/blockcipher@1.0.0","@stablelib/blake2xs@1.0.0","@stablelib/blake2s@1.0.0","@stablelib/blake2b@1.0.0","@stablelib/binary@1.0.0","@stablelib/benchmark@1.0.0","@stablelib/base64@1.0.0","@stablelib/aes@1.0.0","@stablelib/aead@1.0.0","@stablelib/x25519@0.7.5","@stablelib/scrypt@0.10.3","@stablelib/newhope@0.8.2","@stablelib/nacl@0.10.5","@stablelib/keyagreement@0.5.1","@stablelib/ed25519@0.11.0","@stablelib/blake2b@0.10.7","@stablelib/x25519@0.7.4","@stablelib/uuid@0.7.4","@stablelib/tss@0.7.4","@stablelib/random@0.7.4","@stablelib/newhope@0.8.1","@stablelib/nacl@0.10.4","@stablelib/hmac-drbg@0.7.4","@stablelib/ed25519@0.10.9","@stablelib/chacha-drbg@0.7.4","@stablelib/xchacha20poly1305@0.1.1","@stablelib/xchacha20@0.1.1","@stablelib/x25519@0.7.3","@stablelib/uuid@0.7.3","@stablelib/tss@0.7.3","@stablelib/siv@0.7.3","@stablelib/scrypt@0.10.2","@stablelib/random@0.7.3","@stablelib/pbkdf2@0.7.3","@stablelib/newhope@0.8.0","@stablelib/nacl@0.10.3","@stablelib/hmac@0.7.3","@stablelib/hmac-drbg@0.7.3","@stablelib/hkdf@0.7.3","@stablelib/gcm@0.7.3","@stablelib/ed25519@0.10.8","@stablelib/ctr@0.8.0","@stablelib/cmac@0.7.3","@stablelib/chacha20poly1305@0.10.3","@stablelib/chacha-drbg@0.7.3","@stablelib/aes@0.7.3","v0.10.7","v0.10.6","v0.10.5","v0.10.4","v0.10.3","v0.10.2","v0.10.1","v0.10.0","v0.9.0","v0.8.2","v0.8.1","v0.8.0","v0.7.3","v0.7.2","v0.7.1","v0.7.0","v0.6.0","v0.5.0","v0.4.1","v0.4.0","v0.3.2","v0.3.1","v0.3.0","v0.2.5","v0.2.4","v0.2.3","v0.2.2","v0.2.1","v0.2.0","v0.1.2","v0.1.1","v0.1.0","v0.0.2","v0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106448.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N"}]}