steal vulnerable to Prototype Pollution via key variable in babel.js

Description

Prototype pollution vulnerability in function extend in babel.js in stealjs steal via the key variable in babel.js.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.3.0

References

• GHSA-vwhq-pm3r-fjm9
• CVE-2022-37266
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Follow Redirects improperly handles URLs in the url.parse() function - CVE-2023-26159
• Redwood is vulnerable to account takeover via dbAuth "forgot-password - Vulnerability
• AngularJS allows attackers to bypass common image source restrictions - CVE-2024-8372
• Strapi Allows Unauthorized Access to Private Fields via parms.lookup - CVE-2024-56143

Tags:

npm

steal