Confetti vulnerabilities
We track 1 vulnerability in Confetti products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on September 14, 2026.
1vulnerabilities
1critical
0high
0exploited
9.1average CVSS score
Latest Confetti vulnerabilities
- 9.1 Critical severity
yayson: Improperly Controlled Modification of Object Prototype Attributes
Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/leg