Prototype Pollution in mootools

Description

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.5.2

References

• GHSA-x6hx-7gh3-3q98
• snyk.io
• CVE-2021-23432
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Command Injection Vulnerability - CVE-2021-21315
• Prototype Pollution in vConsole - CVE-2023-30363
• Cloudera HUE Account Enumeration - CVE-2016-4947
• Cross-Site Scripting in exceljs - CVE-2018-16459

Tags:

npm

mootools