PrototypeBleed

CVE	Icon	Vulnerability name	Date	Responsible Security Disclosure by	Stars	Process	Vulnerabilities
-		PrototypeBleed	2026-10-02	xet7		Found while auditing per-user layout methods after the 2026-10-02 Hall of Fame review; fixed by xet7.	The per-user layout methods kept maps keyed by the ids a client sent and wrote map[boardId][listId] = value. With __proto__ as the board id, any signed-in user could set a property on every object in the server process until it restarted - for example Meteor.call('setListCollapsedState', '__proto__', 'isAdmin', true). A key that reaches a prototype - __proto__, constructor, prototype - or that MongoDB refuses is no longer accepted as a map key. CWE-1321. High severity: one call by any signed-in user changes every object in the server until restart. No CVE assigned. Fix prepared locally for the Upcoming release; not yet released.

Details

Several per-user layout methods - collapsed lists and swimlanes, list widths and similar view state - store their values in a map on the user, keyed first by board id and then by list or swimlane id, and set them with map[boardId][listId] = value. Both ids came from the client and were checked only to be strings.

With __proto__ as the board id, map[boardId] is Object.prototype, so the write set a property on every object in the server process. Meteor.call('setListCollapsedState', '__proto__', 'isAdmin', true) made isAdmin true on every object that does not have its own, until the server restarted - a value any later check reading a missing property would see. Any signed-in user could make the call.

Fix

A shared assertSafeMapKey refuses __proto__, constructor and prototype, and keys that MongoDB refuses in a field name, before any id-keyed map is written. Every function that writes such a map checks its keys first.

Detection

A refused key is summarized as PrototypeBleed in Admin Panel → Problems (catalog key injection.prototype). The layout code never sends such an id, so every refusal is an attempt; the browser test shows the account that sent it is blocked.

Verification

Unit tests in tests/prototypeBleed.test.cjs run the real method bodies in a sandbox: before the fix the reported call pollutes the prototype, after it the call is refused and nothing is polluted. The negative test fails on any function that writes an id-keyed map without checking its keys first. The browser test tests/playwright/specs/prototype-bleed.e2e.js sends a __proto__ id to the layout methods and checks that it is refused and the account blocked. The unit tests pass in the WeKan repository. The browser test was not run for this page.

Source fix and regression tests