thlorenz browserify-shim vulnerable to prototype pollution (GHSA-cfgr-75jx-h88g)

Description

Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js.

Recommendation

Update the browserify-shim package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.8.15
• Patched version(s): 3.8.16

References

• GHSA-cfgr-75jx-h88g
• CVE-2022-37623
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• thlorenz browserify-shim vulnerable to prototype pollution (GHSA-r737-347m-wqc7) - CVE-2022-37621
• Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify - Vulnerability
• thlorenz browserify-shim vulnerable to prototype pollution - CVE-2022-37617
• Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query - CVE-2025-31125

Tags:

npm

browserify-shim