mde utilities contains Prototype Pollution

Description

All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.0.6

References

• GHSA-wxfj-84xf-7gxv
• security.snyk.io
• CVE-2023-26105
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution in vConsole - CVE-2023-30363
• underscore-keypath vulnerable to Prototype Pollution - CVE-2023-26139
• antfu/utils vulnerable to prototype pollution - CVE-2023-2972
• rangy vulnerable to Prototype Pollution - CVE-2023-26102

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

utilities