GitHub Advisoryadvisory · npm, Maven

GHSA-2m53-83f3-562j Prototype pollution in min-dash

HIGH Published 2022-02-01 Modified 2025-07-18 Official page ↗
Aliases
CVE-2021-23460
Ecosystem
npm, Maven
Packages
min-dash, org.webjars.npm:min-dash
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1321
Reviewed
2022-01-27

Affected packages

• npm min-dash: < 3.8.1 → fixed in 3.8.1 • Maven org.webjars.npm:min-dash: < 3.8.1 → fixed in 3.8.1

Description

Impact The `set` method is vulnerable to prototype pollution with specially crafted inputs. ```javascript // insert the following into poc.js and run node poc,js (after installing the package) let parser = require("min-dash"); parser.set({}, [["__proto__"], "polluted"], "success"); console.log(polluted); ``` Patches `min-dash>=3.8.1` fix the issue. Workarounds No workarounds exist for the issue. References Closed via https://github.com/bpmn-io/min-dash/pull/21. Credits Credits to Cristian-Alexandru STAICU who found the vulnerability and to Idan Digmi from the Snyk Security Team who reported the vulnerability to us, responsibly.

Related

Alias · CVE (1)

  • CVE-2021-23460 The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References