Description
Prototype pollution vulnerability in ‘controlled-merge’ versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.
Recommendation
Update the controlled-merge package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.0.0, < 1.3.0
- Patched version(s): 1.3.0
References
Could your website be exposed too?
SmartScanner can check your website for Prototype pollution in controlled-merge and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Prototype pollution in json8-merge-patch - CVE-2020-8268
- Prototype Pollution in Ajv - CVE-2020-15366
- datatables.net vulnerable to Prototype Pollution due to incomplete fix - CVE-2020-28458
- ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse` - CVE-2020-28462
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023