GitHub Advisoryadvisory · npm

GHSA-58g2-9fqr-36q2 Prototype Pollution in Proto

HIGH Published 2021-09-02 Modified 2021-09-10 Official page ↗
Aliases
CVE-2021-23426
Ecosystem
npm
Packages
Proto
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1321
Reviewed
2021-09-02

Affected packages

• npm Proto: <= 1.1.4 (no fix yet)

Description

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function.

Related

Alias · CVE (1)

  • CVE-2021-23426 This affects all versions of package Proto. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References