Browserslist’s normalizeStats() function processes the untrusted browserslist-stats.json, opts.stats, and CLI --stats data without guarding the for...in loop that accesses and assigns object properties. This permits keys that are inherited from Object.prototype, such as __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf, to either trigger an uncaught TypeError or to write over the prototype of the returned normalized object, effectively enabling prototype pollution and potentially a crash during runtime.

all browserslist releases prior to version 4.28.7 are vulnerable. The vulnerability affects the browserslist tool regardless of the target environment, including Node.js projects that rely on browserslist for configuring front‑end tooling.

The vulnerability carries a CVSS score of 7.5, indicating high severity, but its EPSS score is reported as < 1%, meaning the likelihood of exploitation is low at present. The issue is not listed in the CISA KEV catalog, and no remote exploitation mechanism is known. The attack vector is likely local, where an attacker can supply malicious content in a browserslist-stats.json file or via the --stats option to a build process that runs browserslist, thereby triggering the prototype pollution or crash. If exploited in a broader context, the polluted prototype could be leveraged by other components that rely on Object.prototype behavior.