Prototype poisoning

Description

The issue is as follows: when msgpack5 decodes a map containing a key "__proto__", it assigns the decoded value to __proto__. As you are no doubt aware, Object.prototype.__proto__ is an accessor property for the receiver’s prototype.

Recommendation

Update the msgpack5 package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.0.0, < 5.2.1

  >= 4.0.0, < 4.5.1

  < 3.6.1**

• Patched version(s): **5.2.1

  4.5.1

  3.6.1**

References

• GHSA-gmjw-49p4-pcfm
• www.npmjs.com
• CVE-2021-21368
• CWE-1321
• CWE-915
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• dustjs-linkedin vulnerable to Prototype Pollution - CVE-2021-4264
• Prototype polluation in just-safe-set - CVE-2021-25952
• Prototype Pollution in mootools - CVE-2021-23432
• Prototype pollution in aurelia-path - CVE-2021-41097

Tags:

npm

msgpack5