obx Prototype Pollution

Description

almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/index.js:470), Object.set (obx/build/index.js:269) component.

Recommendation

Update the @almela/obx package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.0.4
• Patched version(s): 0.0.4

References

• GHSA-jj58-488v-4rgf
• CVE-2024-36573
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• jrburke requirejs vulnerable to prototype pollution - CVE-2024-38999
• @ndhoule/defaults prototype pollution - CVE-2024-57066
• vxe-table prototype pollution - CVE-2024-57080
• Blackprint @blackprint/engine Prototype Pollution issue - CVE-2024-24294

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@almela/obx