CVE-2026-33228

CVE-2026-33228 is a critical vulnerability affecting versions of the 'flatted' circular JSON parser prior to 3.4.2. This flaw allows an attacker to inject specific string values as array indices during parsing, leading to global prototype pollution by leaking and modifying Array.prototype. Rated 9.8 Critical on the CVSS scale, it presents a severe risk with a network attack vector, low attack complexity, and no required privileges or user interaction, potentially impacting confidentiality, integrity, and availability. Despite its critical severity, there is currently no evidence of active exploitation, nor are public exploits available in Metasploit, Nuclei, or ExploitDB. Community discussion is minimal, and its very low EPSS score suggests a low probability of exploitation in the wild. Organizations using affected versions should update to 3.4.2 or later to mitigate this risk.