CVE-2026-2964

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2964", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-22T07:26:30.719Z", "datePublished": "2026-02-23T01:02:10.387Z", "dateUpdated": "2026-02-23T13:49:40.324Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T01:02:10.387Z"}, "title": "higuma web-audio-recorder-js Dynamic Config Handling WebAudioRecorder.js extend prototype pollution", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1321", "lang": "en", "description": "Improperly Controlled Modification of Object Prototype Attributes"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "higuma", "product": "web-audio-recorder-js", "versions": [{"version": "0.1", "status": "affected"}, {"version": "0.1.1", "status": "affected"}], "modules": ["Dynamic Config Handling"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in higuma web-audio-recorder-js 0.1/0.1.1. Impacted is the function extend in the library lib/WebAudioRecorder.js of the component Dynamic Config Handling. Such manipulation leads to improperly controlled modification of object prototype attributes. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.6, "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-22T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-22T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-22T17:20:23.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Matan Sandori (2Bsecure)", "type": "finder"}, {"lang": "en", "value": "Joshua Sheridan (2Bsecure)", "type": "finder"}, {"lang": "en", "value": "MatanS (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "MatanS (VulDB User)", "type": "analyst"}], "references": [{"url": "https://vuldb.com/?id.347331", "name": "VDB-347331 | higuma web-audio-recorder-js Dynamic Config Handling WebAudioRecorder.js extend prototype pollution", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347331", "name": "VDB-347331 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.755221", "name": "Submit #755221 | higuma web-audio-recorder-js Latest (0.1.1) Prototype Pollution", "tags": ["third-party-advisory"]}]}, "adp": [{"references": [{"url": "https://vuldb.com/?submit.755221", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-23T13:49:29.475965Z", "id": "CVE-2026-2964", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T13:49:40.324Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2964", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-23T13:49:29.475965Z"}}}], "references": [{"url": "https://vuldb.com/?submit.755221", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T13:49:16.458Z"}}], "cna": {"title": "higuma web-audio-recorder-js Dynamic Config Handling WebAudioRecorder.js extend prototype pollution", "credits": [{"lang": "en", "type": "finder", "value": "Matan Sandori (2Bsecure)"}, {"lang": "en", "type": "finder", "value": "Joshua Sheridan (2Bsecure)"}, {"lang": "en", "type": "reporter", "value": "MatanS (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "MatanS (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.6, "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "higuma", "modules": ["Dynamic Config Handling"], "product": "web-audio-recorder-js", "versions": [{"status": "affected", "version": "0.1"}, {"status": "affected", "version": "0.1.1"}]}], "timeline": [{"lang": "en", "time": "2026-02-22T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-22T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-22T17:20:23.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.347331", "name": "VDB-347331 | higuma web-audio-recorder-js Dynamic Config Handling WebAudioRecorder.js extend prototype pollution", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347331", "name": "VDB-347331 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.755221", "name": "Submit #755221 | higuma web-audio-recorder-js Latest (0.1.1) Prototype Pollution", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in higuma web-audio-recorder-js 0.1/0.1.1. Impacted is the function extend in the library lib/WebAudioRecorder.js of the component Dynamic Config Handling. Such manipulation leads to improperly controlled modification of object prototype attributes. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "Improperly Controlled Modification of Object Prototype Attributes"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T01:02:10.387Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2964", "state": "PUBLISHED", "dateUpdated": "2026-02-23T13:49:40.324Z", "dateReserved": "2026-02-22T07:26:30.719Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-23T01:02:10.387Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Dynamic Config Handling"], "product": "web-audio-recorder-js", "vendor": "higuma", "versions": [{"status": "affected", "version": "0.1"}, {"status": "affected", "version": "0.1.1"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:higuma:webaudiorecorder.js:0.1:*:*:*:*:*:*:*", "matchCriteriaId": "CA3C42AE-4D06-420E-83C0-AE514AA217CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:higuma:webaudiorecorder.js:0.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "6688B040-958C-470B-AD08-EFE40B4E8D71", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in higuma web-audio-recorder-js 0.1/0.1.1. Impacted is the function extend in the library lib/WebAudioRecorder.js of the component Dynamic Config Handling. Such manipulation leads to improperly controlled modification of object prototype attributes. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en higuma web-audio-recorder-js 0.1/0.1.1. Afecta a la funci\u00f3n extend de la biblioteca lib/WebAudioRecorder.js del componente Dynamic Config Handling. Si se manipula se puede provocar una modificaci\u00f3n incontrolada de atributos de prototipo de objeto. Es posible lanzar el ataque de forma remota. Los ataques de esta naturaleza son altamente complejos y se consideran dif\u00edciles de explotar. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. El proveedor fue contactado con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-2964", "lastModified": "2026-06-17T10:32:07.703", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2964", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-23T13:49:29.475965Z", "version": "2.0.3"}}]}, "published": "2026-02-23T02:16:39.643", "references": [{"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.347331"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.347331"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.755221"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.755221"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1321"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.1.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "web-audio-recorder-js", "source": "cna", "vendor": "higuma"}, "product": "web-audio-recorder-js", "vendor": "higuma"}], "analysis": {"en": {"generated_at": "2026-04-18T11:09:16.239361+00:00", "value": {"mitigation_remediation": ["Upgrade higuma web-audio-recorder-js to any released version that addresses the prototype\u2011pollution flaw, if such a version exists.", "Replace dynamic calls to the extend function with explicit property assignments or a wrapper that validates keys against an allowlist before modifying prototypes.", "Sanitize all input values passed to the configuration mechanism, ensuring only trusted and expected data is processed, to prevent unintended prototype manipulation."], "summary": {"action": "Upgrade Library", "impact": "Prototype Pollution"}, "threat_synthesis": {"affected_systems": "Higuma WebAudioRecorder.js, versions 0.1 and 0.1.1, are the only releases that contain the vulnerable extend function. Any web application that imports these specific versions\u2014via npm, CDNs, or direct script tags\u2014is potentially exposed. The vulnerability is tied to the library's core JavaScript, and does not propagate to unrelated modules unless they invoke the extend function.", "description_and_impact": "The extend function in WebAudioRecorder.js accepts dynamic configuration data without proper validation, leading to unsafe modification of JavaScript object prototypes. This prototype pollution flaw, identified as CWE\u20111321, can also allow insertion of executable code through malformed inputs, corresponding to CWE\u201194. The primary impact is that an attacker can alter core objects, which may enable remote code execution or cause unpredictable application behavior. The vulnerable code resides in the lib/WebAudioRecorder.js function extend in higuma web-audio-recorder-js version 0.1/0.1.1.", "risk_and_exploitability": "The CVSS score of 2.3 classifies this as a low\u2011severity vulnerability, which is reinforced by the EPSS score of less than 1\u202f%, indicating a very low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog, suggesting no known large\u2011scale attacks based on this flaw have been observed. Attackers could launch the exploit from a remote malicious web page that loads the vulnerable library and supplies crafted configuration data. While the exploit is publicly available, the complexity of dynamically traversing the library's prototype chain makes successful attacks non\u2011trivial, keeping the overall risk low but not negligible."}}}}, "created": "2026-02-23T14:28:29.732187+00:00", "updated": "2026-04-18T11:15:35.915036+00:00", "vendors": ["higuma", "higuma$PRODUCT$web-audio-recorder-js"]}