GitHub Advisoryadvisory · npm

GHSA-5xjx-4xcm-hpcm Prototype Pollution in ts-nodash

HIGH Published 2021-12-10 Modified 2022-07-05 Official page ↗
Aliases
CVE-2021-23403
Ecosystem
npm
Packages
ts-nodash
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-1321, CWE-915
Reviewed
2021-07-06

Affected packages

• npm ts-nodash: < 1.2.7 → fixed in 1.2.7

Description

`ts-nodash` before version 1.2.7 is vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.

Related

Alias · CVE (1)

  • CVE-2021-23403 All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input. vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References