# prototype pollution issues on dependencies

**URL:** https://discourse.vtk.org/t/prototype-pollution-issues-on-dependencies/16175
**Category:** vtk.js
**Tags:** vtkjs
**Created:** [December 9, 2025, 8:18am UTC](https://discourse.vtk.org/t/prototype-pollution-issues-on-dependencies/16175 "2025-12-09T08:18:16Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![blinkkkkkk](https://discourse.vtk.org/user_avatar/discourse.vtk.org/blinkkkkkk/32/10381_2.png) [@blinkkkkkk](https://discourse.vtk.org/u/blinkkkkkk)
#### Post date: [December 9, 2025, 8:18am UTC](https://discourse.vtk.org/t/prototype-pollution-issues-on-dependencies/16175/1 "2025-12-09T08:18:16Z")

</div>

@kitware/vtk.js rely on  
node\_modules/xmlbuilder2 which depend on /node\_modules/js-yaml  
js-yaml \<3.14.2 which has prototype pollution issues:  
Severity: moderate js-yaml has prototype pollution in merge (\<\<) - [https://github.com/advisories/GHSA-mh29-5h37-fv8m](https://github.com/advisories/GHSA-mh29-5h37-fv8m)

---

<div class="post-metadata">

### Author: ![daker](https://discourse.vtk.org/letter_avatar_proxy/v4/letter/d/e495f1/32.png) [@daker](https://discourse.vtk.org/u/daker)
#### Post date: [May 29, 2026, 10:33pm UTC](https://discourse.vtk.org/t/prototype-pollution-issues-on-dependencies/16175/2 "2026-05-29T22:33:35Z")

</div>

It should be fixed now [Release v36.1.1 · Kitware/vtk-js · GitHub](https://github.com/Kitware/vtk-js/releases/tag/v36.1.1)