Description
A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x (fixed in 3.2.2 and 2.6.4), which could let a malicious user obtain privileges via the mapValues() method.
Recommendation
Update the async package to the latest compatible version. Followings are version details:
Affected version(s): **>= 2.0.0, < 2.6.4 >= 3.0.0, < 3.2.2** Patched version(s): **2.6.4 3.2.2**
References
Could your website be exposed too?
SmartScanner can check your website for Prototype Pollution in async and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Prototype pollution vulnerability in 'patchmerge - CVE-2021-25916
- jquery-plugin-query-object contains prototype pollution vulnerability - CVE-2021-20083
- Prototype Pollution in the merge and clone helper methods - CVE-2021-39227
- Prototype pollution in aurelia-path - CVE-2021-41097
You might also like:
See something that needs correcting? Let us knowUpdated June 24, 2024