Prototype Pollution in phpjs

Description

All versions of phpjs up to and including 1.3.2 are vulnerable to Prototype Pollution via parse_str. phpjs is no longer maintained and users are advised to use Locutus as a replacement (https://github.com/locutusjs/locutus)

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.3.2

References

• GHSA-m428-jqc4-2p5j
• snyk.io
• CVE-2020-7700
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution in lodash - lodash.set - CVE-2020-8203
• Prototype pollution vulnerability in 'deep-set - CVE-2020-28276
• TypeORM vulnerable to MAID and Prototype Pollution - CVE-2020-8158
• Prototype pollution in gsap - CVE-2020-28478

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

phpjs