GitHub Advisoryadvisory · npm

GHSA-593m-55hh-j8gv Sentry SDK Prototype Pollution gadget in JavaScript SDKs

MEDIUM Published 2024-10-03 Modified 2024-10-04 Official page ↗
Ecosystem
npm
Packages
@sentry/browser
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-913
Reviewed
2024-10-03

Affected packages

• npm @sentry/browser: >= 8.0.0-alpha.1, < 8.33.0 → fixed in 8.33.0 • npm @sentry/browser: < 7.119.1 → fixed in 7.119.1

Description

Impact In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue. > [!NOTE] > This advisory does not indicate the presence of a Prototype Pollution within the Sentry SDK itself. Users are strongly advised to first address any Prototype Pollution vulnerabilities in their application, as they pose a more critical security risk. Patches The issue was patched in all Sentry JavaScript SDKs starting from the 8.33.0 version. Also, the fix was backported to SDK v7 in 7.119.1. References • Prototype Pollution • Prototype Pollution gadgets • sentry-javascript#13838

Related

Weakness · CWE (1)

  • CWE-913 Improper Control of Dynamically-Managed Code Resources weakness

References