Prototype Pollution in protobufjs

Description

The package protobufjs is vulnerable to Prototype Pollution, which can allow an attacker to add/modify properties of the Object.prototype. Versions after and including 6.10.0 until 6.10.3 and after and including 6.11.0 until 6.11.3 are vulnerable.

This vulnerability can occur in multiple ways:

1. by providing untrusted user input to util.

Recommendation

Update the protobufjs package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 6.10.0, < 6.10.3

  >= 6.11.0, < 6.11.3**

• Patched version(s): **6.10.3

  6.11.3**

References

• GHSA-g954-5hwp-pp24
• snyk.io
• CVE-2022-25878
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• qs vulnerable to Prototype Pollution - CVE-2022-24999
• protobufjs Prototype Pollution vulnerability - CVE-2023-36665
• steal vulnerable to Prototype Pollution via optionName variable - CVE-2022-37264
• matrix-js-sdk Prototype Pollution vulnerability - CVE-2022-36059

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

protobufjs