CVE-2025-57325
rollbar vulnerable to prototype pollution
Impact
### Impact Prototype pollution potential with the utility function `rollbar/src/utility`.`set()`. No impact when using the published public interface. If application code directly imports `set` from `rollbar/src/utility` and then calls `set` with untrusted input in the second argument, it is vulnerable to prototype pollution. POC: ```js const obj = {}; require("rollbar/src/utility").set(obj, "__proto__.polluted", "vulnerable"); console.log({}.polluted !== undefined ? '[POLLUTION_TRIGGERED]':''); ``` ### Patches Fixed in version 2.26.5 and 3.0.0-beta5. ### Workarounds If application code directly imports `set` from `rollbar/src/utility`, ensure that the second argument does not receive untrusted input. ### References https://github.com/rollbar/rollbar.js/issues/1333#issuecomment-3353720946
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | rollbar | <= 2.26.4 | 2.26.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rollbar | Rollbar | through 2.26.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/rollbar%402.26.4/index.js
- https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57325
- https://github.com/advisories/GHSA-r8c2-2qwq-94p6
- https://github.com/rollbar/rollbar.js/security/advisories/GHSA-r8c2-2qwq-94p6
- https://nvd.nist.gov/vuln/detail/CVE-2025-57325
- https://github.com/rollbar/rollbar.js/issues/1333
- https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343