GitHub Advisoryadvisory · npm

GHSA-fp82-2h99-3fpp Prototype Pollution in async merge-object

CRITICAL Published 2018-09-18 Modified 2022-04-26 Official page ↗
Aliases
CVE-2018-3753
Ecosystem
npm
Packages
merge-object
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321, CWE-20
Reviewed
2020-06-16

Affected packages

• npm merge-object: <= 1.0.0 (no fix yet)

Description

The utilities function in all versions of the merge-object node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Related

Alias · CVE (1)

  • CVE-2018-3753 The utilities function in all versions <= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when… vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-20 Improper Input Validation weakness

References