Advisory: Prototype Pollution in DayPilot Configuration Option Processing - Security

CVE: Pending
Severity: Low
CVSS v4.0: 2.3
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CWE: CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes ("Prototype Pollution")

Summary

DayPilot Lite and DayPilot Pro contain a prototype-pollution vulnerability in component configuration processing.

The issue is only exploitable if an application loads untrusted JSON and passes that JSON, or an object preserving attacker-controlled top-level property names, as the DayPilot component configuration.

For example, this pattern may be exposed:

const config = await fetch("/user-provided-config").then(response => response.json());

const calendar = new DayPilot.Calendar("dp", config);

A specially crafted configuration object containing an own __proto__ property can cause DayPilot to assign an attacker-controlled value to:

Object.prototype.data

This may affect unrelated application or library code running in the same JavaScript realm.

Applications are not affected merely because they load untrusted event, resource, or other ordinary data records. For example, the following pattern does not by itself expose this vulnerability:

const events = await fetch("/events").then(response => response.json());

const calendar = new DayPilot.Calendar("dp", {
    events
});

To exploit the vulnerability, an attacker must be able to control top-level DayPilot configuration property names.

Affected Products

The vulnerability affects DayPilot products containing the vulnerable DayPilot core classes.

The JavaScript, React, Angular, and Vue packages are affected because they all include and export these core classes. The vulnerability is in the core classes, not necessarily in the native framework wrapper components themselves.

Impact

The vulnerable configuration-processing code can unintentionally modify Object.prototype.

The demonstrated primitive allows an attacker-controlled value to be assigned to the fixed property:

Object.prototype.data

Because Object.prototype is shared by ordinary JavaScript objects in the same realm, this may influence unrelated application or third-party library code that reads an inherited data property.

The vulnerability does not directly provide arbitrary property-name pollution, and no direct confidentiality impact has been demonstrated.

Practical exploitation depends on both of the following conditions:

1. The consuming application permits attacker-controlled top-level properties to reach the DayPilot component configuration.

2. Application or third-party code running in the same JavaScript realm consumes the polluted data property in a way that produces a security-relevant effect.

Required Configuration for Exposure

The consuming application must pass attacker-controlled top-level property names as a DayPilot component options object.

For example, an application may be exposed if it forwards an untrusted JSON object directly to a DayPilot constructor or update() method.

Ordinary attacker-controlled event or resource data nested inside an application-controlled DayPilot configuration object is not sufficient to trigger this vulnerability.

Remediation

Upgrade to the fixed DayPilot Lite or DayPilot Pro version listed above.

The corrected implementation prevents prototype-related configuration properties from modifying JavaScript prototypes.

Workaround

If upgrading is not immediately possible, do not pass arbitrary untrusted JSON objects directly as DayPilot component configuration.

Remove or reject any top-level __proto__ property before passing a configuration object to a DayPilot component constructor or update() method.

Credit

Reported by Ridwan Arefin Islam from Madiba Security Lab, Concordia University.

Disclosure Timeline

• 2026-08-21: Vulnerability reported privately to the DayPilot maintainers.

• 2026-08-22: Issue confirmed, analyzed, and fixed.

• 2026-08-22: CVE ID requested from the MITRE CNA of Last Resort.

• 2026-08-25: Fixed releases and this advisory published.