Prototype Pollution in tiny-conf

Description

All versions of package tiny-conf up to and including version 1.1.0 are vulnerable to Prototype Pollution via the set function.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.0

References

• GHSA-4q97-fh3f-j294
• snyk.io
• CVE-2020-7724
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype pollution in controlled-merge - CVE-2020-28268
• Prototype Pollution in gedi - CVE-2020-7727
• Prototype Pollution in promisehelpers - CVE-2020-7723
• Prototype Pollution in phpjs - CVE-2020-7700

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

tiny-conf