GitHub Advisoryadvisory · npm

GHSA-4mvj-rq4v-2fxw Prototype Pollution in x-assign

HIGH Published 2021-10-21 Modified 2022-12-03 Official page ↗

Aliases: CVE-2021-23452
Ecosystem: npm
Packages: x-assign
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weaknesses: CWE-1321, CWE-915
Reviewed: 2021-10-21

Affected packages

• npm x-assign: <= 0.1.4 (no fix yet)

Description

This vulnerability affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object.

Related

Alias · CVE (1)

CVE-2021-23452 This affects all versions of package x-assign. vulnerability

Weakness · CWE (2)

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References