deep-parse-json vulnerable to Prototype Pollution

Description

deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the __proto__ property to be edited.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.0.2

References

• GHSA-ff9j-pwxg-q5p2
• fluidattacks.com
• CVE-2022-42743
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• json-pointer vulnerable to Prototype Pollution - CVE-2022-4742
• deep-object-diff vulnerable to Prototype Pollution - CVE-2022-41713
• Prototype Pollution in deep-get-set - CVE-2022-21231
• steal vulnerable to Prototype Pollution via alias variable - CVE-2022-37265

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

deep-parse-json