The vulnerability in WebReflection's flatted library arises because the parse() function accepts string keys from JSON input as direct array indices without numeric validation. Since the internal buffer is a JavaScript Array, accessing it with the key "__proto__" returns the Array.prototype object. This object is then assigned as a property of the output object, leaking a live reference to Array.prototype. Subsequent writes to this property result in prototype pollution, enabling attackers to modify global prototype attributes. This can lead to arbitrary code execution or denial of service. The flaw is fixed in flatted version 3.4.2.

An unauthenticated remote attacker can exploit this vulnerability by providing specially crafted JSON input to the flatted parser, causing prototype pollution. This can result in arbitrary code execution or denial of service, impacting the confidentiality, integrity, and availability of affected systems. Products that use flatted versions prior to 3.4.2 and process untrusted JSON data are at risk if they do not sanitize input properly.

A fix is available in flatted version 3.4.2. Users and vendors should upgrade to version 3.4.2 or later to remediate this vulnerability. Red Hat has issued advisories and is working on fixes for affected products that incorporate the flatted library. Until patched, avoid processing untrusted JSON data with vulnerable versions or apply input sanitization to prevent prototype pollution.