Rule Explorer

Appending to an array with `$ARR[$ARR.length] = $VAL` invokes [[Set]], which traverses the prototype chain. If Array.prototype[N] has an attacker-installed setter (e.g., from sandbox/cross-realm code), that setter receives the appended value — potentially including sensitive internal state — before the caller regains control. Use Reflect.defineProperty or Ob

JSCVE-2026-44009GHSA-9QJ6-QJGG-37QQCWE-668

`$ARR[$ARR.length] = $VAL` appends to an array via an ordinary index assignment, which walks `Array.prototype` before creating an own slot. In sandbox or cross-realm bridge code, an array literal `[]` allocated inside a closure shared with the untrusted realm inherits that realm's `Array.prototype`. An attacker can pre-install a numeric-index setter (e.g. `O

JSCVE-2026-44008GHSA-9QJ6-QJGG-37QQCWE-668