liquidjs may leak properties of a prototype

Description

The package liquidjs before 10.0.0 is vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided.

Recommendation

Update the liquidjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 10.0.0
• Patched version(s): 10.0.0

References

• GHSA-45rm-2893-5f49
• groups.google.com
• security.snyk.io
• CVE-2022-25948
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Prototype Pollution in fullpage.js - CVE-2022-1295
• Prototype Pollution in madlib-object-utils - CVE-2022-24279
• matrix-js-sdk Prototype Pollution vulnerability - CVE-2022-36059
• Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host - CVE-2026-34076

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

liquidjs