Description
Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal via the requestedVersion variable in the npm-convert.js file.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 2.3.0
References
Could your website be exposed too?
SmartScanner can check your website for steal vulnerable to Prototype Pollution via requestedVersion variable and gives you actionable findings to investigate.
Start a free scanRelated Issues
- steal vulnerable to Prototype Pollution via key variable in babel.js - CVE-2022-37266
- steal vulnerable to Prototype Pollution via optionName variable - CVE-2022-37264
- steal vulnerable to Prototype Pollution via alias variable - CVE-2022-37265
- steal vulnerable to Regular Expression Denial of Service via input variable - CVE-2022-37260
You might also like:
See something that needs correcting? Let us knowUpdated January 30, 2023