Description
vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype.
Recommendation
Update the vega-util package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.13.1
- Patched version(s): 1.13.1
References
Could your website be exposed too?
SmartScanner can check your website for Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify - CVE-2019-10808
- mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes - CVE-2026-41139
- radashi Allows Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') - CVE-2025-48054
- Improperly Controlled Modification of Object Prototype Attributes - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023