Prototype pollution in json8-merge-patch

Description

Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor.

Recommendation

Update the json8-merge-patch package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.3
• Patched version(s): 1.0.3

References

• GHSA-8v9x-9xqg-r8mr
• hackerone.com
• www.npmjs.com
• CVE-2020-8268
• CWE-1321
• CWE-20
• CWE-471
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Prototype pollution in controlled-merge - CVE-2020-28268
• Prototype pollution in json8 - CVE-2020-7770
• Prototype Pollution in field - CVE-2020-28269
• Prototype Pollution in safe-object2 - CVE-2020-7726

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

json8-merge-patch