WebReflection vulnerabilities
We track 2 vulnerabilities in WebReflection products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on March 20, 2026.
2vulnerabilities
1critical
1high
0exploited
8.7average CVSS score
Latest WebReflection vulnerabilities
- 9.8 Critical severity
flatted: Improperly Controlled Modification of Object Prototype Attributes
flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a
- 7.5 High severity
flatted: Uncontrolled Recursion
flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the recursion dept