Prototype pollution exists in ThingsBoard, allowing an attacker who can log into the system with tenant administrator rights to override properties of prototype objects. This flaw can lead to arbitrary code execution within the sandboxed environment, putting confidentiality, integrity, and availability at risk. The weakness belongs to CWE‑1321, which describes improper handling of prototype assignments that can affect all objects inheriting from the polluted prototype.

The affected product is ThingsBoard. No specific versions were listed in the advisory, so all deployments of ThingsBoard that have not applied the patch identified in pull request 15600 are potentially vulnerable. The fix is released in the latest ThingsBoard releases, as documented in the release notes.

The CVSS score of 8.6 indicates a high severity vulnerability. The EPSS score is below 1%, implying that exploitation is unlikely at present, and the vulnerability is not in the CISA KEV catalog. The attack vector is inferred to require authenticated access with tenant administrator privileges, making the scope limited to users who have elevated rights within a tenant. An attacker would need to first authenticate and then exploit the prototype pollution to execute malicious code under the sandbox's boundary.