Description
Conform allows the parsing of nested objects in the form of object.property. Due to an improper implementation of this feature, an attacker can exploit it to trigger prototype pollution by passing a crafted input to parseWith... functions.
Recommendation
Update the @conform-to/zod package to the latest compatible version. Followings are version details:
Affected version(s): **< 0.9.2 >= 1.0.0, <= 1.1.0** Patched version(s): **0.9.2 1.1.1**
References
Could your website be exposed too?
SmartScanner can check your website for Conform contains a Prototype Pollution Vulnerability in `parseWith...` function - @conform-to/zod and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Conform contains a Prototype Pollution Vulnerability in `parseWith...` function - @conform-to/yup - CVE-2024-32866
- Conform contains a Prototype Pollution Vulnerability in `parseWith...` function - CVE-2024-32866
- adolph_dudu ratio-swiper was discovered to contain a prototype pollution via the function extendDefaults - CVE-2024-38997
- @cat5th/key-serializer Prototype Pollution vulnerability - CVE-2024-39018
You might also like:
See something that needs correcting? Let us knowUpdated June 10, 2024