Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible. Patches Fixed in 2.26.5 and 3.0.0-beta5. Workarounds Ensure that values passed to rollbar.configure() do not contain untrusted input. References Fixed in https://github.com/rollbar/rollbar.js/pull/1394 (2.26.x) and https://github.com/rollbar/rollbar.js/pull/1390 (3.x)
Recommended action: Upgrade to 3.0.0-beta5 (pre-release) or 2.26.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Prototype pollution potential with the utility function rollbar/src/utility.set(). No impact when using the published public interface. If application code directly imports set from rollbar/src/utility and then calls set with untrusted input in the second argument, it is vulnerable to prototype pollution. POC: Patches Fixed in version 2.26.5 and 3.0.0-beta5. Workarounds If application code directly imports set from rollbar/src/utility, ensure that the second argument does not receive untrusted input. References https://github.com/rollbar/rollbar.js/issues/1333#issuecomment-3353720946
Recommended action: Upgrade to 3.0.0-beta5 (pre-release) or 2.26.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.