Prototype Pollution in mootools

Description

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.5.2

References

• GHSA-x6hx-7gh3-3q98
• snyk.io
• CVE-2021-23432
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• mootools-more vulnerable to prototype pollution - CVE-2021-20088
• Prototype Pollution in the merge and clone helper methods - CVE-2021-39227
• Prototype Pollution in js-data - js-data - CVE-2021-23574
• Prototype Pollution in cookiex/deep - CVE-2021-23442

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

mootools