GitHub Advisoryadvisory · npm

GHSA-89mq-4x47-5v83 angular Prototype Pollution vulnerability

HIGH Published 2019-11-20 Modified 2025-11-20 Official page ↗
Aliases
CVE-2019-10768
Ecosystem
npm
Packages
angular
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1321, CWE-20, CWE-915
Reviewed
2019-11-20

Affected packages

• npm angular: < 1.7.9 → fixed in 1.7.9

Description

Versions of `angular ` prior to 1.7.9 are vulnerable to prototype pollution. The deprecated API function `merge()` does not restrict the modification of an Object's prototype in the , which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation Upgrade to version 1.7.9 or later. The function was already deprecated and upgrades are not expected to break functionality.

Related

Alias · CVE (1)

  • CVE-2019-10768 In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a… vulnerability

Weakness · CWE (3)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-20 Improper Input Validation weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References