Prototype Pollution in property-expr

Description

The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.

Recommendation

Update the property-expr package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.3
• Patched version(s): 2.0.3

References

• GHSA-6fw4-hr69-g3rv
• snyk.io
• CVE-2020-7707
• CWE-1321
• CWE-915
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• Prototype Pollution in mathjs - CVE-2020-7743
• Prototype Pollution in lodash - lodash-es - CVE-2020-8203
• Prototype Pollution in mout - mout - CVE-2020-7792
• Prototype Pollution in lodash - lodash - GHSA-p6mc-m468-83gw - CVE-2020-8203

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

property-expr