GitHub Advisoryadvisory · npm

GHSA-gm9g-2g8v-fvxj Prototype Pollution in upmerge

MEDIUM Published 2019-06-06 Modified 2021-09-16 Official page ↗
Ecosystem
npm
Packages
upmerge
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-345, CWE-400
Reviewed
2019-06-06

Affected packages

• npm upmerge: <= 0.1.8 (no fix yet)

Description

All versions of `upmerge` are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available.

Related

Weakness · CWE (2)

  • CWE-345 Insufficient Verification of Data Authenticity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References