A prototype pollution flaw in Software Mansion React Native Worklets allows an attacker to supply an object containing a __proto__ property. During serialization, this property is incorporated into the prototype chain of a newly cloned plain JavaScript object. When the malformed object is later processed by a Worklet API, React Native may crash, producing a denial of service to the affected application. The weakness is a Classic Prototype Pollution flaw (CWE‑1321).

The vulnerability impacts applications that use the swmansion:React Native Reanimated library prior to version 0.12.2. Any app that imports React Native Worklets and processes data from external or user‑controlled sources through the affected serialization path is potentially affected. Version 0.12.2 includes the upstream mitigation for unsafe handling of __proto__ during serialization and deserialization.

The CVSS score of 5.3 indicates medium severity. External probability of exploitation is unknown as no EPSS data is available. The vulnerability is not listed in the CISA KEV catalog. A likely attack vector is a remote actor furnishing malicious data to an application’s Worklet API, either via a network or persisted payload, which will then induce a crash upon processing. Because the exploit requires only the ability to supply data to the vulnerable serialization function, a broad class of apps that trust external input face this risk.