Vulnerability in massCode Project

[ankitdn]

Describe the bug

While working on massCode project, I identified a critical vulnerability in the elysia package (CVE-2025-66456). The issue is caused by prototype pollution through the mergeDeep function when multiple standalone schema validations are used, which can lead to remote code execution (RCE).

CVE Link
CVE Report

To reproduce

Uploaded the dependency file to Vulert
After uploading, Vulert automatically scanned the entire dependency tree, including transitive dependencies.

App Version and Architecture

1.4.17

System info

OS: Windows 10

Validations

• Follow our Code of Conduct
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion.

[antonreshetov]

@ankitdn

Thank you for your vigilance. We are aware of these threats, as GitHub provides automated notifications about such security issues in the project.

P.S. The current version of the application, which is actively maintained, is version 4.