Prototype Pollution in gedi

Description

All versions of package gedi up to and including version 1.6.3 are vulnerable to Prototype Pollution via the set function.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.6.3

References

• GHSA-jh2m-j8pp-55rc
• snyk.io
• CVE-2020-7727
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution in lodash - lodash.set - CVE-2020-8203
• Prototype pollution vulnerability in 'deep-set - CVE-2020-28276
• TypeORM vulnerable to MAID and Prototype Pollution - CVE-2020-8158
• Prototype pollution in gsap - CVE-2020-28478

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

gedi