CVE-2025-62517

MEDIUM5.9

Rollbar.js Prototype Pollution Vulnerability in merge()

Published Oct 23, 2025

Modified 2 months ago

No fix available

Details

Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible. This issue has been fixed in versions 2.26.5 and 3.0.0-beta5. A workaround involves ensuring that values passed to rollbar.configure() do not contain untrusted input.

References

WEBhttps://github.com/rollbar/rollbar.js/commit/61032fe6c208b71e249514800808a54bcb8cb8bb WEBhttps://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343 WEBhttps://github.com/rollbar/rollbar.js/pull/1390 WEBhttps://github.com/rollbar/rollbar.js/pull/1394 WEBhttps://github.com/rollbar/rollbar.js/security/advisories/GHSA-xcg2-9pp4-j82x ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-62517

CVSS Analysis

CVSS v3.1

5.9

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

HighI:H

Availability

NoneA:N

5.9/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness Type (CWE)

Input Validation

CWE-1321

Prototype Pollution

Ecosystems

Timeline

PublishedOct 23, 2025

ModifiedOct 23, 2025