thlorenz browserify-shim vulnerable to prototype pollution - browserify-shim

Description

Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js.

Recommendation

Update the browserify-shim package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.8.15
• Patched version(s): 3.8.16

References

• GHSA-r737-347m-wqc7
• CVE-2022-37621
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• thlorenz browserify-shim vulnerable to prototype pollution - CVE-2022-37617
• thlorenz browserify-shim vulnerable to prototype pollution - browserify-shim - GHSA-cfgr-75jx-h88g - CVE-2022-37623
• steal vulnerable to Prototype Pollution via key variable in babel.js - CVE-2022-37266
• steal vulnerable to Prototype Pollution via requestedVersion variable - CVE-2022-37257

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

browserify-shim