Prototype Pollution in arr-flatten-unflatten

Description

All versions of package arr-flatten-unflatten up to and including version 1.1.4 are vulnerable to Prototype Pollution via the constructor.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.4

References

• GHSA-w8f3-pvx4-4c3h
• snyk.io
• CVE-2020-7713
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype pollution in controlled-merge - CVE-2020-28268
• Prototype Pollution in gedi - CVE-2020-7727
• Prototype Pollution in tiny-conf - CVE-2020-7724
• Prototype Pollution in promisehelpers - CVE-2020-7723

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

arr-flatten-unflatten