Improperly Controlled Modification of Object Prototype Attributes

Description

The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Recommendation

Update the think-config package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.3
• Patched version(s): 1.1.3

References

• GHSA-6cj2-92m5-7mvp
• CWE-1321

Related Issues

• radashi Allows Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') - CVE-2025-48054
• mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes - CVE-2026-41139
• Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util - CVE-2019-10806
• Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify - CVE-2019-10808

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

think-config