thlorenz browserify-shim vulnerable to prototype pollution (GHSA-cfgr-75jx-h88g)

Description

Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js.

Recommendation

Update the browserify-shim package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.8.15
• Patched version(s): 3.8.16

References

• GHSA-cfgr-75jx-h88g
• CVE-2022-37623
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• thlorenz browserify-shim vulnerable to prototype pollution (GHSA-r737-347m-wqc7) - CVE-2022-37621
• thlorenz browserify-shim vulnerable to prototype pollution - CVE-2022-37617
• ag-grid packages vulnerable to Prototype Pollution (GHSA-328p-362g-r48j) - CVE-2024-39001
• steal vulnerable to Prototype Pollution via alias variable - CVE-2022-37265

Tags:

npm

browserify-shim