This vulnerability is a classic prototype pollution flaw, where the server accepts a map key from the network wire that, when deserialized by the JavaScript bindings, overwrites an object's __proto__ or prototype property. The result is that shared prototypes can be modified, potentially allowing malicious code to influence the behavior of any object that inherits from the polluted prototype. In JavaScript this can lead to unpredictable execution paths, data corruption, or even remote code execution if subsequent code utilizes the polluted property values. The weakness is described by CWE‑1321, which captures uncontrolled modification of an object's prototype.

The issue affects Apache Thrift implementations that expose JavaScript bindings, specifically any release prior to version 0.25.0. Users who rely on the generated JS client or server code from older Thrift packages are vulnerable. This includes all standard Thrift libraries that support JavaScript, irrespective of language of the other peer.

The CVSS base score of 6.3 indicates a moderate severity with an impact that can affect confidentiality, integrity, and availability. No EPSS score is available, so the likelihood of exploitation is unclear, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to inject a malicious map key into a Thrift message that is processed by the vulnerable JavaScript code, which makes the primary attack vector remote over any network channel that uses Thrift. If an attacker can maintain persistence or execute code against a JavaScript environment that accesses the polluted prototype, the resulting damage could be substantial.