CyberRota Analysis
AI-GeneratedThe vulnerability affects the joi library prior to versions 17.13.8 and 18.2.9, allowing attackers to exploit prototype pollution through custom error messages that include __proto__ keys. This can lead to the alteration of the object's prototype, potentially disrupting the functionality of downstream code that depends on Object.prototype methods. Developers and organizations using affected versions of joi should prioritize updating to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.