steal vulnerable to Prototype Pollution via optionName variable

Description

Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.3.0

References

• GHSA-8f8g-9j73-7p82
• CVE-2022-37264
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• steal vulnerable to Prototype Pollution via key variable in babel.js - CVE-2022-37266
• steal vulnerable to Prototype Pollution via requestedVersion variable - CVE-2022-37257
• steal vulnerable to Prototype Pollution via alias variable - CVE-2022-37265
• steal vulnerable to Regular Expression Denial of Service via input variable - CVE-2022-37260

Tags:

npm

steal