Description
Conform allows the parsing of nested objects in the form of object.property. Due to an improper implementation of this feature, an attacker can exploit it to trigger prototype pollution by passing a crafted input to parseWith... functions.
Recommendation
Update the @conform-to/yup package to the latest compatible version. Followings are version details:
Affected version(s): **< 0.9.2 >= 1.0.0, <= 1.1.0** Patched version(s): **0.9.2 1.1.1**
References
Could your website be exposed too?
SmartScanner can check your website for Conform contains a Prototype Pollution Vulnerability in `parseWith...` function - @conform-to/yup and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Conform contains a Prototype Pollution Vulnerability in `parseWith...` function - CVE-2024-32866
- Conform contains a Prototype Pollution Vulnerability in `parseWith...` function - @conform-to/zod - CVE-2024-32866
- Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo - CVE-2024-21548
- @thi.ng/paths Prototype Pollution vulnerability - CVE-2024-29650
You might also like:
See something that needs correcting? Let us knowUpdated June 10, 2024