GitHub Advisoryadvisory · npm
GHSA-qw93-45r3-p66p Prototype Pollution in merge-options
CRITICAL
Official page ↗
- Aliases
- CVE-2018-3752
- Ecosystem
- npm
- Packages
- merge-options
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-20
- Reviewed
- 2020-06-16
Affected packages
• npm merge-options: < 1.0.1 → fixed in 1.0.1
Description
All versions of `merge-options` are vulnerable to Prototype Pollution
Recommendation
Update to version 1.0.1 or greater.
Related
Alias · CVE (1)
- CVE-2018-3752 The utilities function in all versions <= 1.0.0 of the merge-options node module can be tricked into modifying the prototype of Object when… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-3752 advisory
- https://github.com/schnittstabil/merge-options/commit/d4a93bc2890455e0931ac0779667023e6cb101d4 web
- https://hackerone.com/reports/311336 web
- https://github.com/advisories/GHSA-qw93-45r3-p66p advisory
- https://github.com/schnittstabil/merge-options package
- https://www.npmjs.com/advisories/717 web