Prototype pollution in emit function

Description

A prototype pollution in derby can crash the application, if the application author has atypical HTML templates that feed user input into an object key.

Attribute keys are almost always developer-controlled, not end-user-controlled, so this shouldn’t be an issue in practice for most applications.

Recommendation

Update the derby package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.0.0-beta1, <= 4.0.0-beta.10

  >= 3.0.0, <= 3.0.1

  <= 2.3.1**

• Patched version(s): **4.0.0-beta.11

  3.0.2

  2.3.2**

References

• GHSA-82jv-9wjw-pqh6
• CWE-1321

Related Issues

• jquery-plugin-query-object contains prototype pollution vulnerability - CVE-2021-20083
• Prototype Pollution in lodash.merge (GHSA-h726-x36v-rx45) - Vulnerability
• Prototype Pollution in lodash.mergewith (GHSA-5947-m4fg-xhqg) - Vulnerability
• Prototype Pollution in lodash.mergewith - Vulnerability

Tags:

npm

derby