GitHub Advisoryadvisory · npm

GHSA-6xwr-q98w-rvg7 Prototype Pollution in nconf

HIGH Published 2022-04-13 Modified 2022-04-22 Official page ↗
Aliases
CVE-2022-21803
Ecosystem
npm
Packages
nconf
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-1321
Reviewed
2022-04-22

Affected packages

• npm nconf: < 0.11.4 → fixed in 0.11.4

Description

nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.

Related

Alias · CVE (1)

  • CVE-2022-21803 This affects the package nconf before 0.11.4. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References