thegenetic/cve-2026-2964-labEducational lab demonstrating CVE-2026-2964, a prototype pollution vulnerability in web-audio-recorder-js leading to RCE. Includes vulnerable and fixed servers, setup scripts, and attack payloads for hands-on security training.
This repository contains a complete lab environment for CVE‑2026‑2964, a prototype pollution vulnerability in the web‑audio‑recorder‑js library that can lead to remote code execution under specific conditions.
The lab includes:
index-vulnerable.js) that demonstrates the attack chain.index-fixed.js) that implements proper sanitisation and allowlist validation.Prerequisites:
npm (comes with Node.js)curl (for downloading the library file during setup)Clone the repository and install dependencies:
git clone https://github.com/bughuntblueprint/cve-2026-2964-lab.git
cd cve-2026-2964-lab
npm install
The installation will automatically download the original WebAudioRecorder.js from the higuma GitHub repository and place it in the lib/ folder.
If you prefer to run the setup manually:
npm run setup
The vulnerable server runs on port 3000 and is configured to accept user-controlled configuration that leads to prototype pollution.
node index-vulnerable.js
Expected output:
Original WebAudioRecorder loaded successfully.
Server is running on http://localhost:3000
You can now send requests to http://localhost:3000/api/audio/config. The server will log all incoming payloads and indicate whether pollution occurred.
The fixed server runs on port 3000 and applies both a recursive key sanitisation and an allowlist to block any dangerous keys before they reach the library constructor. Ensure to modify the package.json and point main to index-fixed.js
node index-fixed.js
Expected output:
Original WebAudioRecorder loaded successfully.
Server is running on http://localhost:3000
This lab is intended for educational purposes only. Do not run it on production systems or against any target without explicit authorisation. The techniques shown are meant to help developers and security professionals understand the vulnerability and apply proper defences.