Description
The package protobufjs is vulnerable to Prototype Pollution, which can allow an attacker to add/modify properties of the Object.prototype. Versions after and including 6.10.0 until 6.10.3 and after and including 6.11.0 until 6.11.3 are vulnerable.
This vulnerability can occur in multiple ways:
- by providing untrusted user input to util.
Recommendation
Update the protobufjs package to the latest compatible version. Followings are version details:
Affected version(s): **>= 6.10.0, < 6.10.3 >= 6.11.0, < 6.11.3** Patched version(s): **6.10.3 6.11.3**
References
Could your website be exposed too?
SmartScanner can check your website for Prototype Pollution in protobufjs and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Prototype Pollution in deep-get-set - CVE-2022-21231
- Prototype Pollution in set-in - CVE-2022-25354
- steal vulnerable to Prototype Pollution - CVE-2022-37258
- Prototype Pollution in JSON5 via Parse Method - CVE-2022-46175
You might also like:
See something that needs correcting? Let us knowUpdated November 29, 2023