Prototype Pollution leading to Remote Code Execution in superjson

published 2022-02-09 4 y ago modified 2026-07-08 4 mo ago also GHSA-5888-ffcr-r425 , EUVD-2022-0835

cvss: 9.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.7%; EPSS 2.7% chance of exploitation in 30 days, percentile 85%
public exploits: 0; none known

superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requirement is that the server implements at least one endpoint which uses superjson during request processing. This has been patched in superjson 1.8.1. Users are advised to update. There are no known workarounds for this issue.

Patch / fix

fixed in 4

npm superjson 1.8.1
npm blitz 0.45.3
blitzjs blitz 0.45.3
blitzjs superjson 1.8.1

Exploit prediction

2.68% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/blitz-js/superjson/security/advisories/GHSA-5888-ffcr-r425 referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/advisories/GHSA-5888-ffcr-r425 referenced PoC, tagged "exploit" by a source, unverified
sonarsource.com https://www.sonarsource.com/blog/blitzjs-prototype-pollution/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub	3.1	9.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	superjson	<1.8.1	1.8.1
npm	blitz	<0.45.3	0.45.3

Affected products

blitz-js superjson

Classification

Weakness

CWE-94 Improper Control of Generation of Code
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

github.com /blitz-js/superjson/security/advisories/GHSA-5888-ffcr-r425
web, exploit, third-party-advisory
github.com /advisories/GHSA-5888-ffcr-r425
advisory, exploit, third-party-advisory
sonarsource.com /blog/blitzjs-prototype-pollution/
exploit, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2022-23631
advisory
github.com /blitz-js/superjson
package
sonarsource.com /blog/blitzjs-prototype-pollution
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary