GitHub Advisoryadvisory · npm

GHSA-f7qw-5pvg-mmwp Prototype Pollution in lutils-merge

MEDIUM Published 2019-06-13 Modified 2021-08-16 Official page ↗
Ecosystem
npm
Packages
lutils-merge
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-400
Reviewed
2019-06-13

Affected packages

• npm lutils-merge: <= 0.2.6 (no fix yet)

Description

All versions of `lutils-merge` are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution. Recommendation The package is deprecated and no fixes are available. Consider using an alternative package.

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References