Prototype poisoning

Description

The issue is as follows: when msgpack5 decodes a map containing a key "__proto__", it assigns the decoded value to __proto__. As you are no doubt aware, Object.prototype.__proto__ is an accessor property for the receiver’s prototype.

Recommendation

Update the msgpack5 package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.0.0, < 5.2.1

  >= 4.0.0, < 4.5.1

  < 3.6.1**

• Patched version(s): **5.2.1

  4.5.1

  3.6.1**

References

• GHSA-gmjw-49p4-pcfm
• www.npmjs.com
• CVE-2021-21368
• CWE-1321
• CWE-915
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• Clipboard-based XSS - CVE-2021-41086
• Redwood is vulnerable to account takeover via dbAuth "forgot-password - Vulnerability
• Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
• Incorrect default cookie name and recommendation - Vulnerability

Tags:

npm

msgpack5