This vulnerability resides in the Ractive#set function of ractivejs ractive. By manipulating the keypath argument, an attacker can alter the prototype chain of JavaScript objects, which allows uncontrolled modification of prototype attributes. If the polluted prototypal properties are later accessed or executed, the attacker may inject arbitrary code or alter program behavior, compromising the integrity and confidentiality of the application.

The affected product is ractivejs ractive, with all releases up to and including version 1.4.4 vulnerable. Users running any of these versions should treat the component as exposed to prototype pollution attempts.

The CVSS score is 6.9, indicating a medium severity. The EPSS score is not provided, so the current exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog, but a publicly available exploit exists. The attack can be carried out remotely by supplying a crafted keypath to Ractive#set; no special privileges or local access are required beyond exposure to the vulnerable function.