Prototype Pollution in Proto

Description

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.4

References

• GHSA-58g2-9fqr-36q2
• snyk.io
• www.npmjs.com
• CVE-2021-23426
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• npm package rfc6902 vulnerable to Prototype Pollution - CVE-2021-4245
• Prototype Pollution in record-like-deep-assign - CVE-2021-23402
• Prototype Pollution in sey - CVE-2021-23663
• Prototype pollution in aurelia-path - CVE-2021-41097

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

Proto