GitHub Advisoryadvisory · npm

GHSA-6cj2-92m5-7mvp Improperly Controlled Modification of Object Prototype Attributes

HIGH Published 2021-08-03 Modified 2021-10-08 Official page ↗
Ecosystem
npm
Packages
think-config
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1321
Reviewed
2021-08-02

Affected packages

• npm think-config: < 1.1.3 → fixed in 1.1.3

Description

Impact The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. Patches `[email protected]` patched it, anyone used `think-config` should upgrade to `>=1.1.3` version. References https://cwe.mitre.org/data/definitions/1321.html For more information If you have any questions or comments about this advisory: • Open an issue in thinkjs/thinkjs • Email us at [email protected]

Related

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References