Prototype Pollution in mootools

Description

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.5.2

References

• GHSA-x6hx-7gh3-3q98
• snyk.io
• CVE-2021-23432
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution in sey - CVE-2021-23663
• jquery-plugin-query-object contains prototype pollution vulnerability - CVE-2021-20083
• Baobab vulnerable to Prototype Pollution - CVE-2021-4307
• MrSwitch hello.js vulnerable to prototype pollution - CVE-2021-26505

Tags:

npm

mootools