The vulnerability allows attacker-controlled CBOR map keys named __proto__ to trigger prototype assignment during decoding. This changes the prototype of the resulting JavaScript object, injecting arbitrary properties that can influence system authorization or feature flag checks. The weakness is identified as prototype pollution, enumerated as CWE‑1321. Because the affected code trusts inherited properties, a malicious payload could make downstream code honor attacker‑defined permissions or toggle critical features, effectively compromising integrity and potentially authority enforcement.

The flaw exists in the StableLib @stablelib/cbor library before release 2.0.4. Versions older than 2.0.4 are vulnerable. Packages that depend on this library and use its CBOR decoding routine are affected.

The CVSS score of 8.9 indicates high severity; the EPSS score is not available, but the absence does not imply low risk. The vulnerability is not listed in CISA KEV, suggesting no confirmed exploit in the wild yet. Attackers can trigger it by providing crafted CBOR data containing a key named __proto__ to the decoder, which is typically invoked via network or file input. If the decoding operation is exposed to untrusted sources, the prototype pollution can happen without authentication. Because the weakness alters object prototypes, additional exploitation steps depend on the application logic that uses the decoded object.