Prototype poisoning

Description

The issue is as follows: when msgpack5 decodes a map containing a key "__proto__", it assigns the decoded value to __proto__. As you are no doubt aware, Object.prototype.__proto__ is an accessor property for the receiver’s prototype.

Recommendation

Update the msgpack5 package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.0.0, < 5.2.1

  >= 4.0.0, < 4.5.1

  < 3.6.1**

• Patched version(s): **5.2.1

  4.5.1

  3.6.1**

References

• GHSA-gmjw-49p4-pcfm
• www.npmjs.com
• CVE-2021-21368
• CWE-1321
• CWE-915
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• mootools-more vulnerable to prototype pollution - CVE-2021-20088
• Prototype Pollution in jquery-bbq - CVE-2021-20086
• Prototype Pollution in lutils - CVE-2021-23396
• Prototype Pollution in async - CVE-2021-43138

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

msgpack5