CVE-2026-85063

ADVISORY - github

Summary

Impact

With columns: true and group_columns_by_name: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj['proto'], invoking the proto setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 (Object.hasOwn duplicate check + Object.defineProperty assignment).

Patches

The problem been patched.

Workarounds

Disable usage of both the columns and group_columns_by_name options.

References

issue #496, PR #497

EPSS Score⁠: 0.00325 (0.252)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-1321⁠

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

ADVISORY - github

CWE-1321⁠

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

ADVISORY - redhat

CWE-915⁠

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Impacted images

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.