Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util

Description

vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype.

Recommendation

Update the vega-util package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.13.1
• Patched version(s): 1.13.1

References

• GHSA-6hwh-rqwf-cxxr
• snyk.io
• CVE-2019-10806
• CWE-1321
• CWE-20
• CWE-915
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes - CVE-2019-14863
• Regular Expression Denial of Service (ReDoS) in lodash (GHSA-x5rq-j2xg-h7qm) 3 - CVE-2019-1010266
• Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
• Regular Expression Denial of Service (ReDoS) in lodash (GHSA-x5rq-j2xg-h7qm) 2 - CVE-2019-1010266

Tags:

npm

vega-util