{"id":"CVE-2026-97724","title":"A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object created during serialization in clonePl…","summary":"A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object created during serialization in clonePl…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","cwe":["CWE-1321"],"vendor":"swmansion","product":"React Native Reanimated","affected":["react_native_reanimated >= worklets-0.5.0 < worklets-0.12.2"],"published":"2026-09-25","updated":"2026-09-30","sourceUpdated":"2026-09-30T17:32:07.107","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97724","references":[{"url":"https://docs.swmansion.com/react-native-reanimated/","label":"cve@mitre.org"},{"url":"https://github.com/software-mansion/react-native-reanimated/issues/10436","label":"cve@mitre.org"},{"url":"https://github.com/software-mansion/react-native-reanimated/pull/10451","label":"cve@mitre.org"},{"url":"https://github.com/software-mansion/react-native-reanimated/pull/10462","label":"cve@mitre.org"},{"url":"https://github.com/software-mansion/react-native-reanimated/releases/tag/worklets-0.12.2","label":"cve@mitre.org"},{"url":"https://github.com/software-mansion/react-native-reanimated/issues/10436","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00307,"epssPercentile":0.2332,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-25T13:54:55.193703Z"},"ingestedAt":"2026-09-25T02:58:13.434Z","slug":"CVE-2026-97724","body":"## Overview\n\nA prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object created during serialization in clonePlainJSObject in packages/react-native-worklets/src/memory/serializable.native.ts. When affected data is subsequently processed by React Native Worklets, the malformed serialized object can cause the React Native application to crash. This can result in a remotely triggered denial of service in applications that pass attacker-controlled data through the affected serialization path. In applications where the attacker-controlled data is persisted, the denial of service may persist across application restarts or repeated attempts to access the affected content.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":210864,"id":"CVE-2026-97724","ts":1790345448897,"field":"exploit_available","old":"false","new":"true"}]}