{"id":"CVE-2026-97724","title":"A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object created during serialization in clonePl…","summary":"A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object created during serialization in clonePl…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","cwe":["CWE-1321"],"vendor":"swmansion","product":"React Native Reanimated","affected":["react_native_reanimated >= worklets-0.5.0 < worklets-0.12.2"],"published":"2026-09-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T03:16:59.327","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97724","references":[{"url":"https://docs.swmansion.com/react-native-reanimated/","label":"cve@mitre.org"},{"url":"https://github.com/software-mansion/react-native-reanimated/issues/10436","label":"cve@mitre.org"},{"url":"https://github.com/software-mansion/react-native-reanimated/pull/10451","label":"cve@mitre.org"},{"url":"https://github.com/software-mansion/react-native-reanimated/pull/10462","label":"cve@mitre.org"},{"url":"https://github.com/software-mansion/react-native-reanimated/releases/tag/worklets-0.12.2","label":"cve@mitre.org"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-25T02:58:13.434Z","slug":"CVE-2026-97724","body":"## Overview\n\nA prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object created during serialization in clonePlainJSObject in packages/react-native-worklets/src/memory/serializable.native.ts. When affected data is subsequently processed by React Native Worklets, the malformed serialized object can cause the React Native application to crash. This can result in a remotely triggered denial of service in applications that pass attacker-controlled data through the affected serialization path. In applications where the attacker-controlled data is persisted, the denial of service may persist across application restarts or repeated attempts to access the affected content.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}