Prototype pollution occurs in the Zabbix function searchParamsToObject(), allowing an attacker to inject the property __proto__ through a URL parameter. jQuery then unsafely creates elements that traverse the forged prototype chain, resulting in persistent cross‑site scripting in Maps. This flaw permits an attacker to execute arbitrary JavaScript in the victim’s browser, enabling session hijacking, defacement, or data theft. The vulnerability is a classic example of the "Object Prototype Pollution" weakness (CWE-1321).

Zabbix Zabbix is affected. No specific version details are provided in the advisory.

The CVSS score of 8.5 classifies this as a high‑severity defect. The EPSS score is not reported, and the vulnerability is not listed as a known exploited flaw by CISA. Attackers can trigger the flaw remotely by composing a malicious URL with the __proto__ parameter; because the XSS payload is stored, exploitation can occur whenever the Map resource is accessed. Note: the advisory does not specify an authentication requirement; it is inferred that the attack does not need authentication. Consequently, the risk of compromise is significant for all users accessing the affected Maps pages.