GitHub Advisoryadvisory · npm

GHSA-33f9-j839-rf8h Prototype Pollution in immer

CRITICAL Published 2021-09-02 Modified 2024-04-25 Official page ↗
Aliases
CVE-2021-23436
Ecosystem
npm
Packages
immer
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321, CWE-843
Reviewed
2021-09-02

Affected packages

• npm immer: >= 7.0.0, < 9.0.6 → fixed in 9.0.6

Description

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition `(p === "__proto__" || p === "constructor")` in `applyPatches_` returns false if `p` is `['__proto__']` (or `['constructor']`). The `===` operator (strict equality operator) returns false if the operands have different type.

Related

Alias · CVE (1)

  • CVE-2021-23436 This affects the package immer before 9.0.6. vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-843 Access of Resource Using Incompatible Type weakness

References