datatables.net vulnerable to Prototype Pollution due to incomplete fix

Description

All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.

Recommendation

Update the datatables.net package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.10.22
• Patched version(s): 1.10.22

References

• GHSA-m7j4-fhg6-xf5v
• snyk.io
• security.netapp.com
• CVE-2020-28458
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• shvl vulnerable to prototype pollution - CVE-2020-28278
• dset vulnerable to prototype pollution - CVE-2020-28277
• MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827 - CVE-2025-67898
• yargs-parser Vulnerable to Prototype Pollution - CVE-2020-7608

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

datatables.net