Prototype Pollution in Proto

Description

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function.

Recommendation

No fix is available yet. Followings are affected versions:

<= 1.1.4

References

GHSA-58g2-9fqr-36q2
snyk.io
www.npmjs.com
CVE-2021-23426
CWE-1321
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Prototype Pollution in Proto and gives you actionable findings to investigate.

Start a free scan

Related Issues

npm package rfc6902 vulnerable to Prototype Pollution - CVE-2021-4245
Prototype Pollution in record-like-deep-assign - CVE-2021-23402
Prototype Pollution in sey - CVE-2021-23663
Prototype pollution in aurelia-path - CVE-2021-41097

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated February 01, 2023