CVE-2026-23929: Prototype pollution leading to stored XSS
Published Aug 18, 2026
·Updated
Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain.
Event History
Aug 18, 2026
CVE Published
via MITRE·12:16 PM
Data Sourced
via MITRE·12:16 PM
RemedyDescriptionWeakness
Frequently Asked Questions
1
Which part of the application should be prioritized for triage?
The affected functionality is Maps, where URL parameters processed by searchParamsToObject() can be used to influence later element creation.
2
What input does an attacker need to control to exploit this issue?
An attacker needs to control URL parameter values that are processed by searchParamsToObject(), including dangerous property names such as __proto__. The resulting prototype-chain manipulation is then used by jQuery's unsafe element creation and can produce persistent script execution.