The vulnerability is a prototype pollution flaw (CWE‑1321) that allows authenticated users with write access to manipulate JavaScript object prototypes during synchronization. This flaw can elevate their privileges beyond the intended scope by injecting properties into shared objects, potentially giving them control over server‑side data structures. The CVSS score of 9.9 underscores its critical severity.

All installations of DEEPSTREAM.io prior to version 10.0.5 are affected. The issue was addressed in release 10.0.5 and later versions.

Based on the description, the likely attack vector is an authenticated user possessing write permissions; no unauthenticated access is required. With no EPSS score available, the exploitation likelihood cannot be quantified. Though not listed in the CISA KEV catalog, the critical nature of the flaw warrants immediate mitigation.