Improper Input Validation in klona

Description

Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona.

Recommendation

Update the klona package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.1.0
• Patched version(s): 1.1.1

References

• GHSA-8f89-2fwj-5v5r
• hackerone.com
• CVE-2020-8125
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Improper Input Validation in SocksJS-Node - CVE-2020-7693
• Improper Input Validation in access-policy - CVE-2020-7674
• Improper Input Validation in Google Closure Library - CVE-2020-8910
• Improper Neutralization of Input During Web Page Generation in CKEditor4 - CVE-2020-27193

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

klona