steal vulnerable to Prototype Pollution via key variable in babel.js

Description

Prototype pollution vulnerability in function extend in babel.js in stealjs steal via the key variable in babel.js.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.3.0

References

• GHSA-vwhq-pm3r-fjm9
• CVE-2022-37266
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• steal vulnerable to Prototype Pollution via requestedVersion variable - CVE-2022-37257
• steal vulnerable to Prototype Pollution via optionName variable - CVE-2022-37264
• steal vulnerable to Prototype Pollution via alias variable - CVE-2022-37265
• steal vulnerable to Prototype Pollution - CVE-2022-37258

Tags:

npm

steal