MiguelCastillo @bit/loader Prototype Pollution issue

Description

A Prototype Pollution issue in MiguelCastillo @bit/loader v.10.0.3 allows an attacker to execute arbitrary code via the M function e argument in index.js.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 10.0.3

References

• GHSA-8vr4-h4rr-8ph6
• CVE-2024-24293
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Blackprint @blackprint/engine Prototype Pollution issue - CVE-2024-24294
• json-schema-ref-parser Prototype Pollution issue - CVE-2024-29651
• robinweser fast-loops vulnerable to prototype pollution - CVE-2024-39008
• Prototype pollution in ag-grid-community via the _.mergeDeep function - ag-grid-enterprise - CVE-2024-38996

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@bit/loader