Prototype Pollution in mithril
Summary
GHSA-c3px-v9c7-m734: Prototype Pollution in mithril. Affects mithril across 2 version ranges.
< 1.1.7
>= 2.0.0, < 2.0.2
Fixed in 1.1.7 or 2.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mithril is an open-source JavaScript framework for building single-page applications. It provides a simple and efficient way to create interactive user interfaces. However, certain versions of Mithril are vulnerable to prototype pollution.
Vulnerability Detail
The vulnerability in Mithril lies in the parseQueryString function. This function can be exploited by a malicious user to manipulate the prototype of the Object class, leading to the addition or modification of properties that will affect all objects. By injecting a payload like __proto__%5BtoString%5D=123 in the query string, the toString() function can be changed to 123. This can have various consequences depending on how the affected code uses the toString() function.
How To Fix
Latest published version: 2.3.8 as of 23 Oct 2026
npm install mithril@2.3.8Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.1.71.1.7npm install mithril@1.1.7 -
>= 2.0.0, < 2.0.22.0.2npm install mithril@2.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the patched versions is the best solution.
Conclusion
Prototype pollution in Mithril can allow an attacker to modify the prototype of objects, leading to unintended changes in the behavior of the affected code. To mitigate this vulnerability, it is crucial to upgrade to the patched versions of Mithril. Additionally, tools like Vulert can help in identifying and monitoring open-source vulnerabilities in your software. Stay proactive in keeping your applications secure.
See every vulnerability recorded for mithril →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker is able to modify the prototype of an object, leading to unintended changes in the behavior of the affected code.
An attacker can exploit prototype pollution to modify existing properties, add new properties, or change the behavior of functions. This can lead to various security issues, such as remote code execution or information disclosure.
You can use tools like Vulert (https://vulert.com) to check if your application is affected by this vulnerability. Vulert analyzes your package-lock.json file and alerts you in real-time for open-source vulnerabilities.
There are no known public exploits of this vulnerability at the moment. However, it is always recommended to patch vulnerabilities as soon as possible to prevent any potential attacks.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide assistance and guidance in fixing the vulnerability.
