CVE-2026-97724 Details
Description
A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object created during serialization in clonePlainJSObject in packages/react-native-worklets/src/memory/serializable.native.ts. When affected data is subsequently processed by React Native Worklets, the malformed serialized object can cause the React Native application to crash. This can result in a remotely triggered denial of service in applications that pass attacker-controlled data through the affected serialization path. In applications where the attacker-controlled data is persisted, the denial of service may persist across application restarts or repeated attempts to access the affected content.
A prototype pollution vulnerability exists in Software Mansion React Native Worklets versions prior to 0.12.2. This vulnerability allows an attacker to manipulate the prototype of an object during serialization, using an object that includes a __proto__ property. The issue arises in the 'clonePlainJSObject' function within 'packages/react-native-worklets/src/memory/serializable.native.ts'. When the corrupted data is processed by React Native Worklets, it can cause the application to crash, creating a denial-of-service condition. This issue is particularly problematic for applications that store attacker-controlled data, as the disruption can persist even after the application is restarted.
Users can update to React Native Worklets version 0.12.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/software-mansion/react-native-reanimated/issues/10436 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://docs.swmansion.com/react-native-reanimated/ | [email protected] | ProductVendor |
| https://github.com/software-mansion/react-native-reanimated/issues/10436 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/software-mansion/react-native-reanimated/pull/10451 | [email protected] | Issue TrackingVendor |
| https://github.com/software-mansion/react-native-reanimated/pull/10462 | [email protected] | Issue TrackingVendor |
| https://github.com/software-mansion/react-native-reanimated/releases/tag/worklets-0.12.2 | [email protected] | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Software Mansion React Native Worklets | < 0.12.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | [email protected] |