Description
Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 2.3.0
References
Related Issues
- Astro allows unauthorized third-party images in _image endpoint - CVE-2025-55303
- rgb2hex vulnerable to inefficient regular expression complexity - CVE-2018-25061
- jQuery-UI vulnerable to Cross-site Scripting in dialog closeText - CVE-2016-7103
- steal vulnerable to Regular Expression Denial of Service via input variable - CVE-2022-37260
- Tags:
- npm
- steal
Anything's wrong? Let us know Last updated on January 30, 2023