Validation Bypass in kind-of

Description

Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation.

Recommendation

Update the kind-of package to the latest compatible version. Followings are version details:

• Affected version(s): >= 6.0.0, < 6.0.3
• Patched version(s): 6.0.3

References

• GHSA-6c8f-qphg-qjgp
• snyk.io
• www.npmjs.com
• CVE-2019-20149
• CWE-668
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Prototype Pollution in lodash - CVE-2018-3721
• Cross-site Scripting in quill - CVE-2021-3163
• Prototype Pollution in async - CVE-2021-43138
• Joplin Remote Code Execution - CVE-2022-40277

Tags:

npm

kind-of