Description
The issue is as follows: when msgpack5 decodes a map containing a key "__proto__", it assigns the decoded value to __proto__. As you are no doubt aware, Object.prototype.__proto__ is an accessor property for the receiver’s prototype.
Recommendation
Update the msgpack5 package to the latest compatible version. Followings are version details:
Affected version(s): **>= 5.0.0, < 5.2.1 >= 4.0.0, < 4.5.1 < 3.6.1** Patched version(s): **5.2.1 4.5.1 3.6.1**
References
Could your website be exposed too?
SmartScanner can check your website for Prototype poisoning and gives you actionable findings to investigate.
Start a free scanRelated Issues
- mootools-more vulnerable to prototype pollution - CVE-2021-20088
- Prototype Pollution in jquery-bbq - CVE-2021-20086
- Prototype Pollution in lutils - CVE-2021-23396
- Prototype Pollution in async - CVE-2021-43138
You might also like:
See something that needs correcting? Let us knowUpdated January 29, 2023