Prototype Pollution in mootools

Description

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.5.2

References

• GHSA-x6hx-7gh3-3q98
• snyk.io
• CVE-2021-23432
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Baobab vulnerable to Prototype Pollution - CVE-2021-4307
• Prototype Pollution in sey - CVE-2021-23663
• npm package rfc6902 vulnerable to Prototype Pollution - CVE-2021-4245
• Prototype Pollution in nedb - CVE-2021-23395

Tags:

npm

mootools