Prototype Pollution in promisehelpers

Description

All versions of package promisehelpers up to and including version 0.0.5 are vulnerable to Prototype Pollution via the insert function.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.0.5

References

• GHSA-rj5f-7c8x-gjg4
• snyk.io
• CVE-2020-7723
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution in lodash - lodash.set - CVE-2020-8203
• Prototype pollution vulnerability in 'deep-set - CVE-2020-28276
• TypeORM vulnerable to MAID and Prototype Pollution - CVE-2020-8158
• Prototype pollution in gsap - CVE-2020-28478

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

promisehelpers