CVE-2025-62517

Rollbar.js offers error tracking and logging from Javascript to Rollbar. In versions before 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5, there is a prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible. This issue has been fixed in versions 2.26.5 and 3.0.0-beta5. A workaround involves ensuring that values passed to rollbar.configure() do not contain untrusted input.

• CWE-1321

• https://github.com/rollbar/rollbar.js/commit/61032fe6c208b71e249514800808a54bcb8cb8bb
• https://github.com/rollbar/rollbar.js/commit/d717def8b68f4a947975d0aebb729869cdb2d343
• https://github.com/rollbar/rollbar.js/pull/1390
• https://github.com/rollbar/rollbar.js/pull/1394
• https://github.com/rollbar/rollbar.js/security/advisories/GHSA-xcg2-9pp4-j82x

Published

Oct 23, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62511yt-grabber-tui is a C++ terminal user interface application …6.3
• CVE-2025-62512Piwigo is an open source photo gallery application for the w…5.3
• CVE-2025-62513OpenBao is an open source identity-based secrets management …7.5
• CVE-2025-62514Parsec is a cloud-based application for cryptographically se…7.1
• CVE-2025-62515pyquokka is a framework for making data lakes work for time …9.8
• CVE-2025-62516Rejected reason: Further research determined the issue is no…
• CVE-2025-62518astral-tokio-tar is a tar archive reading/writing library fo…8.1
• CVE-2025-62519phpMyFAQ is an open source FAQ web application. Prior to ver…7.2
• CVE-2025-6252The Qi Addons For Elementor plugin for WordPress is vulnerab…5.4
• CVE-2025-62520Mantis Bug Tracker (MantisBT) is an open source issue tracke…4.3
• CVE-2025-62521ChurchCRM is an open-source church management system. Prior …9.8
• CVE-2025-62522Vite is a frontend tooling framework for JavaScript. In vers…6