CVE-2025-62517

Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible. This issue has been fixed in versions 2.26.5 and 3.0.0-beta5. A workaround involves ensuring that values passed to rollbar.configure() do not contain untrusted input.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/rollbar/rollbar.js/commit/61032fe6c208b71e249514800808a54bcb8cb8bb
https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343
https://github.com/rollbar/rollbar.js/pull/1390
https://github.com/rollbar/rollbar.js/pull/1394
https://github.com/rollbar/rollbar.js/security/advisories/GHSA-xcg2-9pp4-j82x

Configurations

No configuration.

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Rollbar.js ofrece seguimiento y registro de errores de Javascript a Rollbar. En versiones anteriores a la 2.26.5 y desde la 3.0.0-alpha1 hasta antes de la 3.0.0-beta5, existe una vulnerabilidad de contaminación de prototipos en merge(). Si el código de la aplicación llama a rollbar.configure() con entrada no confiable, la contaminación de prototipos es posible. Este problema ha sido solucionado en las versiones 2.26.5 y 3.0.0-beta5. Una solución alternativa implica asegurar que los valores pasados a rollbar.configure() no contengan entrada no confiable.

Information

Published : 2025-10-23 20:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-62517

Mitre link : CVE-2025-62517

CVE.ORG link : CVE-2025-62517

JSON object : View

Products Affected

No product.

CWE

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2025-62517", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62517", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-23T20:13:17.247458Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "rollbar", "product": "rollbar.js", "versions": [{"status": "affected", "version": "< 2.26.5"}, {"status": "affected", "version": ">= 3.0.0-alpha1, < 3.0.0-beta5"}]}]}], "published": "2025-10-23T20:15:41.057", "references": [{"url": "https://github.com/rollbar/rollbar.js/commit/61032fe6c208b71e249514800808a54bcb8cb8bb", "source": "security-advisories@github.com"}, {"url": "https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343", "source": "security-advisories@github.com"}, {"url": "https://github.com/rollbar/rollbar.js/pull/1390", "source": "security-advisories@github.com"}, {"url": "https://github.com/rollbar/rollbar.js/pull/1394", "source": "security-advisories@github.com"}, {"url": "https://github.com/rollbar/rollbar.js/security/advisories/GHSA-xcg2-9pp4-j82x", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible. This issue has been fixed in versions 2.26.5 and 3.0.0-beta5. A workaround involves ensuring that values passed to rollbar.configure() do not contain untrusted input."}, {"lang": "es", "value": "Rollbar.js ofrece seguimiento y registro de errores de Javascript a Rollbar. En versiones anteriores a la 2.26.5 y desde la 3.0.0-alpha1 hasta antes de la 3.0.0-beta5, existe una vulnerabilidad de contaminaci\u00f3n de prototipos en merge(). Si el c\u00f3digo de la aplicaci\u00f3n llama a rollbar.configure() con entrada no confiable, la contaminaci\u00f3n de prototipos es posible. Este problema ha sido solucionado en las versiones 2.26.5 y 3.0.0-beta5. Una soluci\u00f3n alternativa implica asegurar que los valores pasados a rollbar.configure() no contengan entrada no confiable."}], "lastModified": "2026-10-08T11:10:00.250", "sourceIdentifier": "security-advisories@github.com"}