Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify

Description

utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.

Recommendation

Update the utilitify package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.3
• Patched version(s): 1.0.3

References

• GHSA-9534-h433-2rjf
• snyk.io
• CVE-2019-10808
• CWE-1321
• CWE-915
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util - CVE-2019-10806
• mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes - CVE-2026-41139
• radashi Allows Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') - CVE-2025-48054
• Improperly Controlled Modification of Object Prototype Attributes - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

utilitify