Exposure of Resource to Wrong Sphere in valib

Description

valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function (hasOwnProperty) from the unsafe user-input to examine an object.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.0.0

References

• GHSA-pmpr-vc5q-h3jw
• snyk.io
• www.npmjs.com
• CVE-2019-10805
• CWE-668
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Exposure of Sensitive Information to an Unauthorized Actor in nanoid - CVE-2021-23566
• bson-objectid contains Improper input validation - CVE-2019-19729
• websocket-driver: Resource limit bypass via message compression - CVE-2026-54490
• Sensitive Data Exposure in msrcrypto - CVE-2018-8319

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

valib