GHSA-vh7f-3c46-hfp3: 
JavaScript vulnerability analysis and mitigation

Your SECURITY.md lists "prototype pollution or similar object-integrity issues via parsed field values or crontab variable names" as in scope, so I am sending this here rather than as a public issue even though the practical impact is low. CronFileParser.#parseContent (src/CronFileParser.ts:61 and :69) stores crontab variables and per-line parse errors with plain bracket assignments on {} literals: result.variables[key] = value.replace(/["']/g, ''); ... result.errors[entry] = err; A key of __proto__ hits the Object.prototype.__proto__ setter instead of creating a property. Two effects, both local to the returned result object (global Object.prototype is not modified):

1. A crontab line consisting of __proto__ fails to parse, and the assignment result.errors['__proto__'] = err replaces the prototype of result.errors with the TypeError. Every property of that error (message, stack, name) then appears as an inherited property of errors, Object.keys(errors) omits the line, and code that walks errors with in or reads errors.message sees the error's properties as if they were entries.
2. A variable line __proto__=value is dropped silently: result.variables neither records it nor reports an error. Preconditions: the attacker controls the crontab content being parsed. Applications that parse user-supplied crontab files (an admin UI, a scheduler that imports crontabs) and then inspect errors or variables are the ones affected. Reproduction (unmodified main a70b68e, 2026-10-20) Crontab content: __proto__, __proto__=polluted, 0 0 * * * ok, constructor, FOO=bar (one per line), parsed with CronFileParser.parseFileSync: errors keys: [ 'constructor' ] errors proto is Object.prototype: false errors proto: TypeError: expression.trim is not a function errors.message (inherited through replaced proto): expression.trim is not a function variables keys: [ 'FOO' ] global Object.prototype polluted? ({}).message: undefined Same result through the async parseFile. Fix Define both entries as own properties (Object.defineProperty with enumerable, writable and configurable set), so __proto__ becomes an ordinary key. The patch below does that and adds a regression test in tests/CronFileParser.test.ts. With it: 349/349 tests pass, eslint, prettier and the type tests are clean. Happy to open it as a PR, or you can take the patch directly. Found with the Quality Playbook (an AI code-review and test-generation skill I maintain); I reproduced it and reviewed the fix myself.

From 3460e2896e77e9fae641dd03e02ee8dcd5604848 Mon Sep 17 00:00:00 2001
From: Andrew Stellman <andrew@stellman.com>
Date: Tue, 20 Oct 2026 15:52:28 -0400
Subject: [PATCH] fix: define crontab variables and errors as own properties in
 CronFileParser
A crontab line or variable named __proto__ was assigned with a plain
bracket assignment on a {} literal, which hits the Object.prototype
__proto__ setter: a line "__proto__" that fails to parse replaces the
prototype of the returned errors object with the error, and a variable
"__proto__=..." is dropped. Define both as own properties instead.
Adds a regression test.
---
 src/CronFileParser.ts        | 15 +++++++++++++--
 tests/CronFileParser.test.ts | 10 ++++++++++
 2 files changed, 23 insertions(+), 2 deletions(-)
diff --git a/src/CronFileParser.ts b/src/CronFileParser.ts
index c815fc0..463c77e 100644
--- a/src/CronFileParser.ts
+++ b/src/CronFileParser.ts
@@ -58,7 +58,13 @@ export class CronFileParser {
       const variableMatch = entry.match(/^(.*)=(.*)$/);
       if (variableMatch) {
         const [, key, value] = variableMatch;
-        result.variables[key] = value.replace(/["']/g, ''); // Remove quotes
+        // Define an own property so that a key such as `__proto__` cannot replace the prototype
+        Object.defineProperty(result.variables, key, {
+          value: value.replace(/["']/g, ''), // Remove quotes
+          enumerable: true,
+          writable: true,
+          configurable: true,
+        });
         continue;
       }
 
@@ -66,7 +72,12 @@ export class CronFileParser {
         const parsedEntry = CronFileParser.#parseEntry(entry);
         result.expressions.push(parsedEntry.interval);
       } catch (err: unknown) {
-        result.errors[entry] = err;
+        Object.defineProperty(result.errors, entry, {
+          value: err,
+          enumerable: true,
+          writable: true,
+          configurable: true,
+        });
       }
     }
 
diff --git a/tests/CronFileParser.test.ts b/tests/CronFileParser.test.ts
index 828a06c..8e8c97f 100644
--- a/tests/CronFileParser.test.ts
+++ b/tests/CronFileParser.test.ts
@@ -114,6 +114,16 @@ describe('CronFileParser', () => {
       }
     });
 
+    test('keeps a line named __proto__ as an own property instead of replacing the prototype', () => {
+      (fs.readFileSync as jest.Mock).mockReturnValueOnce(['__proto__', '__proto__=polluted', 'ok=1'].join('\n'));
+      const result = CronFileParser.parseFileSync('./temp-proto.txt');
+
+      expect(Object.getPrototypeOf(result.errors)).toBe(Object.prototype);
+      expect(Object.getPrototypeOf(result.variables)).toBe(Object.prototype);
+      expect(Object.keys(result.errors)).toEqual(['__proto__']);
+      expect(Object.keys(result.variables)).toEqual(['__proto__', 'ok']);
+    });
+
     test('throws error for non-existing file', () => {
       expect(() => CronFileParser.parseFileSync('./nonexistent.txt')).toThrow('File not found');
       expect(fs.readFileSync).toHaveBeenCalledWith('./nonexistent.txt', 'utf8');