dot-lens vulnerable to Prototype Pollution

Description

All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.2.3

References

• GHSA-rmhg-2cvv-q7vx
• security.snyk.io
• CVE-2023-26106
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• antfu/utils vulnerable to prototype pollution - CVE-2023-2972
• underscore-keypath vulnerable to Prototype Pollution - CVE-2023-26139
• Collection.js vulnerable to Prototype Pollution - CVE-2023-26113
• mockjs vulnerable to Prototype Pollution via the Util.extend function - CVE-2023-26158

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

dot-lens