Description
Prototype pollution vulnerability via .parse() in Plist allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.
Recommendation
Update the plist package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.0.5
- Patched version(s): 3.0.5
References
Could your website be exposed too?
SmartScanner can check your website for Prototype pollution in Plist before 3.0.5 can cause denial of service and gives you actionable findings to investigate.
Start a free scanRelated Issues
- string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS) - CVE-2025-45143
- ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution - CVE-2022-25907
- Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS) - CVE-2023-25653
- steal vulnerable to Regular Expression Denial of Service via source and sourceWithComments - CVE-2022-37262
You might also like:
See something that needs correcting? Let us knowUpdated November 29, 2023