Description
flat helps flatten/unflatten nested Javascript objects. A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes (‘prototype pollution’).
Recommendation
Update the flat package to the latest compatible version. Followings are version details:
Affected version(s): **= 5.0.0 >= 4.0.0, < 4.0.2 = 3.0.0 >= 2.0.0, < 2.0.2 < 1.6.2** Patched version(s): **5.0.1 4.0.2 3.0.1 2.0.2 1.6.2**
References
Could your website be exposed too?
SmartScanner can check your website for flat vulnerable to Prototype Pollution and gives you actionable findings to investigate.
Start a free scanRelated Issues
- datatables.net vulnerable to Prototype Pollution due to incomplete fix - CVE-2020-28458
- TypeORM vulnerable to MAID and Prototype Pollution - CVE-2020-8158
- dset vulnerable to prototype pollution - CVE-2020-28277
- keyget vulnerable to prototype pollution - CVE-2020-28272
You might also like:
See something that needs correcting? Let us knowUpdated January 21, 2026