The vulnerability resides in the parse() function of the flatted library, which accepts attacker‑controlled string values from the JSON payload as array index keys without validating that they are numeric. When a value such as "__proto__" is used, the JavaScript runtime resolves it to the Array prototype, which is then assigned as a property of the parsed object. This exposes a live reference to Array.prototype, allowing an attacker to modify the global prototype chain and, consequently, to tamper with any code that relies on array behavior or to execute arbitrary logic. The weakness is a classic prototype‑pollution flaw (CWE‑1321) combined with improper handling of prototype references (CWE‑915).

The issue affects the WebReflection flatted package for Node.js, specifically all releases prior to version 3.4.2. Applications that import flatted and deserialize user‑supplied JSON, such as browsers, backend services, or any tooling that relies on this library, are potentially vulnerable until they upgrade to 3.4.2 or later.

Because the vulnerability is directly triggered by an attacker‑controlled JSON document, exploitation requires the ability to supply malicious input to parse(). The CVSS score of 8.9 classifies it as high severity, while the EPSS score of less than 1 % indicates a low probability of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation. However, prototype pollution can lead to subtle compromise or denial of service, so the risk is notable, especially in critical services that rely on parsed JSON.