stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named __proto__ invokes the inherited setter and causes parsed object prototype replacement instead of creating an own data property. Applications that make authorization or feature decisions from inherited values can therefore consume attacker-controlled properties, and a null prototype can disrupt code that expects Object.prototype methods. The researcher treats parsing untrusted JSON as part of the project contract, while the maintainer states that documented inputs are locally owned dumps, exports, or logs and characterizes the attack vector as local. The global Object.prototype is not polluted. This issue is fixed in version 3.6.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory
    footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key
    named __proto__ invokes the inherited setter and causes parsed object prototype replacement instead of
    creating an own data property. Applications that make authorization or feature decisions from inherited
    values can therefore consume attacker-controlled properties, and a null prototype can disrupt code that
    expects Object.prototype methods. The researcher treats parsing untrusted JSON as part of the project
    contract, while the maintainer states that documented inputs are locally owned dumps, exports, or logs and
    characterizes the attack vector as local. The global Object.prototype is not polluted. This issue is fixed
    in version 3.6.0. (CVE-2026-104183)

ID	Name	Product	Family	Type	Severity
478035	Chainguard: kubeflow-pipelines-frontend: security update to 2.18.0-r0	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
478035	Chainguard: kubeflow-pipelines-frontend: security update to 2.18.0-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
473031	SCA: security update for stream-json (GHSA-mjw6-4jj6-33hc)	Tenable Cloud Security	SCA Checks	Local	medium
473031	SCA: security update for stream-json (GHSA-mjw6-4jj6-33hc)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-104183

medium

Tenable Plugins

medium

medium

medium

medium