GitHub Advisoryadvisory · npm

GHSA-2g4c-8fpm-c46v web3-utils Prototype Pollution vulnerability

HIGH Published 2024-03-27 Modified 2024-03-27 Official page ↗
Aliases
CVE-2024-21505
Ecosystem
npm
Packages
web3-utils
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1321
Reviewed
2024-03-27

Affected packages

• npm web3-utils: >= 4.0.1, < 4.2.1 → fixed in 4.2.1

Description

Impact: The mergeDeep() function in the web3-utils package has been identified for Prototype Pollution vulnerability. An attacker has the ability to modify an object's prototype, which could result in changing the behavior of all objects that inherit from the impacted prototype by providing carefully crafted input to function. Patches: It has been fixed in web3-utils version 4.2.1 so all packages and apps depending on web3-utils >=4.0.1 and <=4.2.0 should upgrade to web3-utils 4.2.1. Workarounds: None

Related

Alias · CVE (1)

  • CVE-2024-21505 Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due… vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References