GitHub Advisoryadvisory · npm

GHSA-p5g9-rjcf-95vj fastest-json-copy vulnerable to Prototype Pollution

MEDIUM Published 2022-11-04 Modified 2022-11-08 Official page ↗
Aliases
CVE-2022-41714
Ecosystem
npm
Packages
fastest-json-copy
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-1321
Reviewed
2022-11-08

Affected packages

• npm fastest-json-copy: <= 1.0.1 (no fix yet)

Description

fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the `__proto__` property to be edited.

Related

Alias · CVE (1)

  • CVE-2022-41714 fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References