GHSA-g9cg-h3jm-cwrc

What it actually does

Prototype pollution via improper input validation allows an attacker to add or modify properties on Object.prototype through crafted payloads processed by the vulnerable parser.

Why it matters to the business

Attackers may alter application behavior, cause denial of service, or achieve remote code execution in affected Node.js services, leading to downtime, data exposure, and remediation costs; widespread use of the library increases organizational exposure.

How an attack unfolds

An attacker crafts a malicious payload containing prototype-polluting keys and submits it to an endpoint that uses the vulnerable subtext parser; successful pollution then influences subsequent object operations to bypass logic checks or execute attacker-controlled code.

How to fix it

Upgrade the affected package to a non-vulnerable version; for the listed Alpine python3 packages apply the update to 3.10.14-r0 or later.

How to confirm the fix worked

Verify the installed package version against the fixed release, review dependency trees for the vulnerable library, and re-run application tests that exercise input parsing paths.

Typical attack path

1. Locate an application endpoint that accepts untrusted input processed by @hapi/subtext
2. Craft a payload containing keys such as '__proto__' or 'constructor.prototype'
3. Submit the payload via HTTP request or API call
4. Trigger code paths that access or iterate over polluted objects
5. Leverage modified prototype properties to achieve desired attacker outcome

How to detect it

Review application and web server logs for requests containing prototype-pollution patterns such as repeated '__proto__' keys; examine process memory or object dumps for unexpected inherited properties after parsing untrusted input.

What your security team should do

• Immediately audit all services using @hapi/subtext and schedule upgrades
• Prioritize patching in internet-facing applications given the 2020 disclosure date
• Add dependency scanning to CI pipelines to prevent reintroduction of vulnerable versions